ramnit | 876bae962c056965896c668dd4d10ca0a4a004197cfdb1364ae0de28413153ca

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-12-2024 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118.exe
Size

274KB
MD5

d9ddeb1469426da75f9be466fd7f633b
SHA1

421452c775270f419a7c99039f3c609c50fe922f
SHA256

876bae962c056965896c668dd4d10ca0a4a004197cfdb1364ae0de28413153ca
SHA512

9f3400fa9de3e076d97259995b4ef14e6c7eea62f55d69befa531d83b85bb536c5b7c391505fe87ea80c7ea68cdfb3935033f47e0f39e7108acccee76efd30e2
SSDEEP

3072:PuyzghIGeQeWuRjUYxV2wbJ5Bd234AIEa/RougHdYa9EAmyIlcNFWbIa0RpjIwHJ:P9VbpUYxV2w0qEIaCAhlIC/7Nr

Score

10^/10

ramnit banker discovery spyware stealer trojan upx worm

Malware Config

Signatures

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Ramnit family
ramnit

Executes dropped EXE 3 IoCs

pid	Process
2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe
2948	winhelp.exe
2892	winhelpmgr.exe

Loads dropped DLL 4 IoCs

pid	Process
2168	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118.exe
2168	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118.exe
2948	winhelp.exe
2948	winhelp.exe

Drops file in System32 directory 63 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{50AA49A1-B632-11EF-9D33-D6FE44FD4752}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{50AA49A1-B632-11EF-9D33-D6FE44FD4752}.dat	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	IEXPLORE.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites\desktop.ini	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\FeedsStore.feedsdb-ms	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\Favorites\Links	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ieonline.microsoft[1]	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PrivacIE\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{50AA49A1-B632-11EF-9D33-D6FE44FD4752}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\favicon[1].ico	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{50ACAB01-B632-11EF-9D33-D6FE44FD4752}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{50ACAB01-B632-11EF-9D33-D6FE44FD4752}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\TabRoaming	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{50ACAB01-B632-11EF-9D33-D6FE44FD4752}.dat	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatCache\Low	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{50ACAB03-B632-11EF-9D33-D6FE44FD4752}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\Favorites\Links\Suggested Sites.url	iexplore.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	IEXPLORE.EXE
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{50AA49A3-B632-11EF-9D33-D6FE44FD4752}.dat	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml	iexplore.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Feeds\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\WebSlices~\Suggested Sites~.feed-ms	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	ie4uinit.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\History\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Virtualized	iexplore.exe
File opened for modification	C:\Windows\System32\config\systemprofile\Favorites\Links\desktop.ini	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-2845162440\msapplication.xml	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\DNTException\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low	iexplore.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IECompatUACache\Low	iexplore.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00080000000120f9-2.dat	upx
behavioral1/memory/2660-14-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2660-11-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2660-17-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2660-16-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2892-30-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2892-34-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2892-32-0x0000000000400000-0x000000000045D000-memory.dmp	upx
behavioral1/memory/2660-357-0x0000000000400000-0x000000000045D000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	\??\c:\windows\help\winhelp.exe	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118.exe
File opened for modification	\??\c:\windows\help\winhelp.exe	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118.exe
File created	\??\c:\windows\help\winhelpmgr.exe	winhelp.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhelp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winhelpmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe

Modifies Internet Explorer settings 1 TTPs 52 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50567C81-B632-11EF-9D33-D6FE44FD4752} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5056A391-B632-11EF-9D33-D6FE44FD4752} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439913136"	iexplore.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Passport\LowDAMap	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CE0DE308-37D1-4200-A46D-AD1F9E59DC62}\WpadNetworkName = "Network 3"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\AppDataLow	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\iexplore	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\iexplore\Count = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Recovery	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Setup	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	iexplore.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2300000023000000430300007b020000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Setup\UrlHistoryMigrationTime = a0bb2f133f4adb01	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\LowCache	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-56-55-fa-02-ca\WpadDecision = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}\Enum	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-56-55-fa-02-ca\WpadDecisionTime = 8089cb143f4adb01	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021493-0000-0000-C000-000000000046}\Enum	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{50ACAB01-B632-11EF-9D33-D6FE44FD4752} = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	iexplore.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{CE0DE308-37D1-4200-A46D-AD1F9E59DC62}\2a-56-55-fa-02-ca	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\User Preferences\88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000146a6ce9b20cf64c97957a307d498cbc00000000020000000000106600000001000020000000df8afea086ddaaf67757d446a45cd794dd9f794638bca86ed8723a6c8425aaf3000000000e8000000002000020000000acf04e2836cd31f46d2a6a0620fd130d1fb14ed5a81423c3ec4f59468a9d9fd350000000b169170f9e1e6f86f767ff65fa0cc62f3fde423469fddc5cd7432dc8cc5d63a8225100a9018c3eb4b7e481decae6f64439a58543d31ab28491abf645fece9e0ed9b5b54ea9741d437afb730f467c9b2d4000000017bbb208d7ecd4fa5b55ff91f4bc95024c258bde41240c2dd5939301d1ccd5b9f107050313fb3888b816821d01db1624f3085cd217fd22eca2c15c67fab62431	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}\Enum	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories64\{00021494-0000-0000-C000-000000000046}\Enum\Implementing = 1c00000001000000e8070c00010009000d0022002400060300000000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\F12	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\Component Categories\{00021494-0000-0000-C000-000000000046}\Enum	IEXPLORE.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-56-55-fa-02-ca	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	iexplore.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\VerCache = 0086a9a807ccca010086a9a807ccca01000000009093660000000e00e803991200000e000000991209040000	iexplore.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe
2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe
2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe
2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe
2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe
2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe
2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe
2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe
2892	winhelpmgr.exe
2892	winhelpmgr.exe
2892	winhelpmgr.exe
2892	winhelpmgr.exe
2892	winhelpmgr.exe
2892	winhelpmgr.exe
2892	winhelpmgr.exe
2892	winhelpmgr.exe
2948	winhelp.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe
Token: SeDebugPrivilege	2892	winhelpmgr.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
2704	iexplore.exe
2836	iexplore.exe
672	iexplore.exe
672	iexplore.exe
616	iexplore.exe
616	iexplore.exe
616	iexplore.exe
616	iexplore.exe
616	iexplore.exe
616	iexplore.exe
616	iexplore.exe
616	iexplore.exe
672	iexplore.exe
672	iexplore.exe
672	iexplore.exe
672	iexplore.exe
672	iexplore.exe
672	iexplore.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
2704	iexplore.exe
2704	iexplore.exe
2928	IEXPLORE.EXE
2928	IEXPLORE.EXE
2836	iexplore.exe
2836	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
672	iexplore.exe
672	iexplore.exe
616	iexplore.exe
616	iexplore.exe
1208	IEXPLORE.EXE
1208	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2660	2168	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2660	2168	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2660	2168	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118.exe	30
PID 2168 wrote to memory of 2660	2168	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118.exe	30
PID 2660 wrote to memory of 2836	2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe	31
PID 2660 wrote to memory of 2836	2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe	31
PID 2660 wrote to memory of 2836	2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe	31
PID 2660 wrote to memory of 2836	2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe	31
PID 2660 wrote to memory of 2704	2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe	32
PID 2660 wrote to memory of 2704	2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe	32
PID 2660 wrote to memory of 2704	2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe	32
PID 2660 wrote to memory of 2704	2660	d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe	32
PID 2704 wrote to memory of 2928	2704	iexplore.exe	33
PID 2704 wrote to memory of 2928	2704	iexplore.exe	33
PID 2704 wrote to memory of 2928	2704	iexplore.exe	33
PID 2704 wrote to memory of 2928	2704	iexplore.exe	33
PID 2836 wrote to memory of 2564	2836	iexplore.exe	34
PID 2836 wrote to memory of 2564	2836	iexplore.exe	34
PID 2836 wrote to memory of 2564	2836	iexplore.exe	34
PID 2836 wrote to memory of 2564	2836	iexplore.exe	34
PID 2948 wrote to memory of 2892	2948	winhelp.exe	36
PID 2948 wrote to memory of 2892	2948	winhelp.exe	36
PID 2948 wrote to memory of 2892	2948	winhelp.exe	36
PID 2948 wrote to memory of 2892	2948	winhelp.exe	36
PID 2892 wrote to memory of 672	2892	winhelpmgr.exe	37
PID 2892 wrote to memory of 672	2892	winhelpmgr.exe	37
PID 2892 wrote to memory of 672	2892	winhelpmgr.exe	37
PID 2892 wrote to memory of 672	2892	winhelpmgr.exe	37
PID 2892 wrote to memory of 616	2892	winhelpmgr.exe	38
PID 2892 wrote to memory of 616	2892	winhelpmgr.exe	38
PID 2892 wrote to memory of 616	2892	winhelpmgr.exe	38
PID 2892 wrote to memory of 616	2892	winhelpmgr.exe	38
PID 672 wrote to memory of 3020	672	iexplore.exe	39
PID 672 wrote to memory of 3020	672	iexplore.exe	39
PID 672 wrote to memory of 3020	672	iexplore.exe	39
PID 616 wrote to memory of 2380	616	iexplore.exe	40
PID 616 wrote to memory of 2380	616	iexplore.exe	40
PID 616 wrote to memory of 2380	616	iexplore.exe	40
PID 672 wrote to memory of 1208	672	iexplore.exe	41
PID 672 wrote to memory of 1208	672	iexplore.exe	41
PID 672 wrote to memory of 1208	672	iexplore.exe	41
PID 672 wrote to memory of 1208	672	iexplore.exe	41
PID 616 wrote to memory of 2308	616	iexplore.exe	42
PID 616 wrote to memory of 2308	616	iexplore.exe	42
PID 616 wrote to memory of 2308	616	iexplore.exe	42
PID 616 wrote to memory of 2308	616	iexplore.exe	42

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Users\Admin\AppData\Local\Temp\d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe
  C:\Users\Admin\AppData\Local\Temp\d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2836
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2564
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2928

\??\c:\windows\help\winhelp.exe
c:\windows\help\winhelp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2948
- \??\c:\windows\help\winhelpmgr.exe
  c:\windows\help\winhelpmgr.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:672
  - - C:\Windows\System32\ie4uinit.exe
      "C:\Windows\System32\ie4uinit.exe" -ShowQLIcon
      4⤵
      Drops file in System32 directory
      PID:3020
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:672 CREDAT:275457 /prefetch:2
      4⤵
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies data under HKEY_USERS
      Suspicious use of SetWindowsHookEx
      PID:1208
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    3⤵
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:616
  - - C:\Windows\System32\ie4uinit.exe
      "C:\Windows\System32\ie4uinit.exe" -ShowQLIcon
      4⤵
      Drops file in System32 directory
      PID:2380
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:616 CREDAT:275457 /prefetch:2
      4⤵
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
deb59f0f8b592f7f610e2c78e9586368

SHA1
5acb35dcb75f1988ef6dae6fb2d37cb7d9c8847c

SHA256
29a884ba38948f99737aec1b117d9a126ec2fbc0c9a2c70c61179ef89dbf115e

SHA512
bfc9293c8a2441c80d075d6afbf5032691371cc4bb7e02bdb83467b30ae311207f604d1a5134aec67765f60de46b9c68d786017422ac608806be6f9d4e08e9f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73eb19f1246cef41661f44db5d9d085a

SHA1
848f90d9fea3657914f331e3a38d0b8db5091702

SHA256
75243ca8663d2e2a760de76103733f391191d76ce2b77360e99ae11d1f1fc200

SHA512
ac964e460acc598851eb229f7670a99b8d4d6545e4352cb2960e57e1d6d0ee7405d65ddccda94062194324af33cf1c01ca72732dd892bb3241edf2ad6e9cb5cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
286bbbb79a10bad68936a5bf33ae663b

SHA1
3ea18749c8a65342ca8da88102301f8d842c4876

SHA256
405cb2a3bc04e3a9969c3c873bca9ee0154867430b4af6ec79809a89a061c29b

SHA512
809952c36cc2fdd6f3713cef293195d552303fc5c413e52e4755cfcbc893670c8ba88711279a5725adf251f1597e2202a701c3e82c1568f0e995eccc8a491abe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
703336f648b72817fbb7984cecfc0b3e

SHA1
84cd17ed4c854ebd2027942e4ec880aeeb3f5367

SHA256
881a5031c71fab66eb2fff85ac7a31f715c392c0060d94f7fc3f24e99dfd7790

SHA512
e7c8fed8d7afbdeb5f67290097ef6dc78e44583fa3d5ca6c8d9a414013a578d13a629342501103a6f3a9c4fa9959c2a8a65cab0e4b9adc7b6692cda1b0c7316b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e06e995249335f0894bf976c9d36df59

SHA1
3d56b8b5959d192c0f23cbe765f45609614d2dd4

SHA256
59a6cc47b876c749e7f00fc830fdf7e4faeb540576617647558114d18b01db84

SHA512
3fde5c1cc19be4340b283980823a249109f62cf8e9342a409c6ea95c39e05fd362074047ae38bed80e8b4a83fa112c52c4be033819525117136aa8912fb77ce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8edf29cc7a4818bdca2ef867fe6a1f27

SHA1
e5109547855b277d31eba9228d6fb6b053306531

SHA256
b241370fa72e10739416d2b67655d30b3e4bab2c1618676a7034c4a5ed1d73ae

SHA512
099027bc5a3b6875b5f5d8c6f13c9f56437a52d818c6421921d9f49f8dbad1c6d9165bf9150ccdfef23d67747a5897cc860902fe80e1a42f681f2a893626b880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1148f451e1de985c273d6c611185c54

SHA1
b9fff5871bbb85f1060c5a4ce2bb690741bf0ff2

SHA256
8b7a4d65d44009e921357f8e2a7b1fe0447cdd570ac281866d0b287fc546a5c9

SHA512
1926ece9e2a0d76dd5c004812b5d3fe6d80b42b38372bf9decfbb2f1731917999faec170e77d06815c50abc2c0b3b6a8a4289d959940bd3ad9c6b09f50c35f63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b5d4431d70a5b8ba8c4d0eb4a603e83

SHA1
c10e5d70b449dba888ba0695f8f80ec1e2bb5788

SHA256
a156cc9fcafbdcf9e1bec2ccde5ce26535799e5c2f711933ab1c74da0fdd77e9

SHA512
f6c92fcda230a1a02f8d208c140f9e9c56b3f8b4f171ae6909b20884fc30328a5ae760be58685c64b9367dfc51ebd4b49d97e0f6adae3fbe8ec5afffa520e23e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d1c8fc7536913dce59442391387ae35

SHA1
0de8b409ec1e6b2d7ee63d43dcf91ba9227a49bc

SHA256
ce205ccaf2ca75cf077ecc55000515cc314bb14f437562a5b369cc1660130f1a

SHA512
b9ae771586cf3b3844b3a1fb9015f8710c0fa23c885670afd469a2cf92d913c16a51c9b9309ca8e44b385e5cefdf05d86abc83979be1e34753069e9e839a1086

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba62dff506b8860eaa2db8d36ecef0e6

SHA1
f5da3ec8b91545152f365dd43c6beeb96aa29d74

SHA256
593e1781dde47844dbcfe992e02dbe0b1713ae5f6219855875c8ee08127ac6ff

SHA512
c7dbd99544b86c7c4a664a827096bbe3beb85d3c2d11b92c533132f29b4b4f2e1c60d9d21e79c869e5c1881f4400a53737cb50af2091cc5257ccc63bb7ef0d24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5bc36a83720821d5e99531710b6ff22

SHA1
a41526418284237492c0f549c9ee7ee4fe9cf6d0

SHA256
32e4993b36ad0e5d2520da343daa784d13e8ce2fadf420308f242a067cb50df2

SHA512
0373adca317da9448b11724c0ed8798ac30c7bc0089942d1ac4bcb95c7d706b2aa7247717d58c36811070cf422a47fa2986eef24f9a68221842071096b0b7819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
148b2cc915b83f7b7ade02c17310a24f

SHA1
f17604aac4570b60ea54f6a367d9a1c181b438bc

SHA256
8ffaddeffb69637f6a8470982dd2425554fe167395d9fcba4b7e571b2cae9a4c

SHA512
a227a5ca4da2f464d141a13577da116600ad40b2cddb4c3ad6af08aba3c4ff4d510aab4c2f29e1762ddb8371348ae1f1c3e76ec78043e3514a0f70650e760149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e1dc141112f42146c31f5b253e77037

SHA1
9b91a6af89b4f0eb2f756d5de9db8672d9558aa0

SHA256
abae8f89e5648db6e73d9f9ba731fbf542f179c52e1bec019b77230145883acb

SHA512
38b4529167c38229c88be5235f063e3ef44eea741aff9230a0755376310ae317418e2b4b856add732213e88a8112f4f50e7cbb49595da574bd0d3c23da0b895d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d529b97c603faa9fed8233c578f74c75

SHA1
4c0c59d40a9e4704378a06818e9c5c6698851b1f

SHA256
56f6a5df777c6d713972d9591fed8aee2102e67aaa195a88c14b799fda720e70

SHA512
7b3fe507f2bfd817a2e53f144aee9f9cacdd5ad7553e05fd35d74a8e7a644b5754c0034fb9b8e15dff8e844fc09209f19038c7f4871f53fdd4039f0664c41f3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c67e8278a69acbc58ecb842905e65e93

SHA1
af9a41b81bc2a541ab6a362c5cc2f877e6b56f17

SHA256
d2e39bb8e5e8657ead49dd6174657123ce96a372d41c3cb5c813fbe2fee416f8

SHA512
dcaeca49a5dce8a5fb3782d1b5da969e191aa2c51f898cbbef48c3bf54ac33ccdb1d8b67aac4b2cbbeb668d00aabe52d193ee1ca8ae7269d3628ba87cd63e3ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e78fa93c9b68be252a2d8a0f80ddea70

SHA1
77d1720a3b79600151ad6fe3cf4a157026a88309

SHA256
7133ad9a1699f0de9fe3ad33cb0a8b60f3e4b1ba4bb54869c29d61ccba2ae39d

SHA512
9d8b40db717e640f64b40f1b8338937afec85e8150524894603b473fb3d4e31ac7b4bef29321517cb907e62896ba2c02f8b8bb6d34b5c7e0ac0ddc2bc42b7004

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed39d7003fa178a754cfbfe2b852a9a9

SHA1
3bf3f167ba4ff725a3285d41eeb92327b9161d07

SHA256
571443b5130d40488f9e8536c2f89311a9fbe351ca5d2a8abb076fbb532e78d5

SHA512
e2b8eda320cb542ff1337ebbb889e4761bbe2c8f889dad87a4f01f9f28e601c1477c690359a5c84e970a1920ca9c661778e956b112e6d2c41103a0362c5396d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b1819515b71a5d64274ead526dc987a

SHA1
551f0102d3d700adb05b02221ca3ce185e6b0c7b

SHA256
7937e33504f0eaa692d950b312b2ea052a9a415281c338cba5f09b8608e08576

SHA512
ae7daf8782dc2ec583d82ebe942e7bc3d37cf1f762ccc58f8c0a7b183a668ff4a0cecd5b477e23abbfeaea9c54a874aed6f2a53431585fab4c44f44645db57fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac7c7683c7929942dcfd79f2ea75eea4

SHA1
d47769319783124f4c4f66029c11a0547971d9dc

SHA256
10d1a3e5d470f1f2f0eee49325dc5e826c03aee0cab199a6b98ffd89803a30e3

SHA512
77493c9c3570334c3a9febf4ee54fa6bf81fb9a8f7775067bb767dce08f82c975a4917a62c2c2c269f991327f4684abcefa25a7900fbf0e5373aeec0f53225c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{5056A391-B632-11EF-9D33-D6FE44FD4752}.dat

Filesize
5KB

MD5
6a94fbed35f51cdfef51f7d1765de141

SHA1
78b3d40711b94cffecc3b11d3ad3139665e664a2

SHA256
77744114b977fca7b3f63f189f53f0626e8e9b911d8a552475196e3bed774c38

SHA512
a7c8e39b8b311459cd2f12231e2daa78f995c77755a646c3f1e0f6b18787199e7760b604ec1763874d5c8c8c76323b07c5b70a97d9352d46519e97cbbfd25a66

Download Submit
C:\Windows\Help\winhelp.exe

Filesize
274KB

MD5
d9ddeb1469426da75f9be466fd7f633b

SHA1
421452c775270f419a7c99039f3c609c50fe922f

SHA256
876bae962c056965896c668dd4d10ca0a4a004197cfdb1364ae0de28413153ca

SHA512
9f3400fa9de3e076d97259995b4ef14e6c7eea62f55d69befa531d83b85bb536c5b7c391505fe87ea80c7ea68cdfb3935033f47e0f39e7108acccee76efd30e2

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c2787d6e1f7de78d6a23bb5bf4db9f01

SHA1
106eddadacfac1746eccc539a8ad05263281533c

SHA256
925c111ea3307a7025e3c867dea69b65d750be356af58be28e7100bef7353c49

SHA512
aaf8351051b03e07cdc9a0d006066d48850024df6e720e3ad9ab94bed51fe7862b9f70d91c886cfbd31b455ff0dfc27466dcd9010b646222b79a686f4d6bf6e6

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a4acd07cea80c94e7c9f9600426af8c

SHA1
0bc6e67c58c15da8191e9c278847d7e34403ecda

SHA256
626bd7e3ecb9e3dc20fbc08543dd3a71d886fa302ef8778b96f7fe592272aee3

SHA512
9d2f79b7be0e9b26e452757d39c35e9efaccfa01fb2bb50192752030795b4140168dd6f4ceaff66ff918a786b09d4eae99ad96bffbdb63fb8c996b8605d440fe

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27d085c980fa66ff44bde83695a2713f

SHA1
2ad78e20cc18c5bcbe38bfc2dd25d6993802f14d

SHA256
7a45a1eec17426a260753af9e67eadc08ac43e9507efced8f378b4d77408241a

SHA512
5448438972728732f32b31376b21111591a24c23770d8d66f925122517bcfe1937dc0e38d81a5a22e91873f3d48e96fef0d39bb44d229260f62bc641e3bca879

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84fa5294e93838b4eb8152feb168afe6

SHA1
a581db898e4f608bb26d609ffbd2966bec7af499

SHA256
96c067b9128e639a7bc6c8365c8a11a2de49a174b7b3a1fd37c7142304fc24d0

SHA512
2df17990651245702015a32971780475571169926d03d9ab1bbed452d74766363ed6c52067f3441ba733c88d664dab23fe13174e9a6d337f9fdbf5146999cfc3

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3842560ac08e0eb6749dd65a07fa9af1

SHA1
2095db6308423dc88d399f8e28af6560b04eca69

SHA256
447d28e4948f9911ed5673626fac4e9c1edbdf8f20218aeeab4d085fe9ce63f1

SHA512
ae5b1e376e84acd51dd064dfffa9d8b7e5f4a60213fb97a778f585e1ec063d4f337843e1e415a2e758b036296fad2524302566855f45d501aefaf6c456d0cbaf

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fd9eb8460a5be72454cdf32cbb0d6c6

SHA1
8ea77f4d296d2eab1da5cae35853bfcee79e7efe

SHA256
762f1251a97924746ca2412e28a51508480e5e35311ac71eeca68d931c3c6cac

SHA512
ffb7cb61dbe372a7b076ba02f8f12d8506a042e0cd082e36497688316a9791f75508084f6ae579abcd37374c618da33246cb7fe9f677860ed0097e4abae9966d

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85dd618e26c4181b788aed965bb0eb1b

SHA1
486c70c95a3e4b6c4627af9d14af9ec034a44199

SHA256
85d50786f6196c10e19e6a488e69621e87d06201fb3745dd42aa5d0757ce0857

SHA512
3901757689ae627e310dd71976c814b23b26b4e1cd141083d95b769ff7af80c9b28dec000cc5579ad8f85df3e98698811cc6a946b69464cb3e787cddf0c7a7e3

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
912ace42a408bb54c590731173599990

SHA1
c9c1d6ca017ba33c5d5508473ca7d1bb93a2a4dd

SHA256
899d574a4cc676e6bcc1b7b407a0ff9d1029c1f61ae5f3116d5a70e18cdc63b6

SHA512
9b1fe197998e3fd539cb4db15da3215325746d762490299a7c05d367bfddcf6d5be9093490f57654cb1f5fa9da4411f7f83464a23ad1000faef80624434a32f5

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a6e94a5b7e4a8e112c8510f53560d63

SHA1
021842ca14565c703eef6a7216f366ee26ff1224

SHA256
eb3abffde8ed96bf6b6afc0116879e52e2e4b04f5884da61c7396f76886b8c1b

SHA512
84d5279445d83779ba84bb473b13ea6fb764a3e47435aa8dc84bd93948c8ff2798ed154081748c205b4914382bfa3f3e1de4d5a55a04097383c125592b14a1dc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6d26656031e9b3650cea97577f3373b

SHA1
7177d256cc5ece7905393713f3b31be0c6b469a5

SHA256
e87045a8ae5e38fbb7f6e9b19be75a2424bee1a615e810e19c8f1f7b17b6d4cb

SHA512
04e3df778a28d6be46155b4cc77e64eef615f7433cd6e432fef1c2a84a36656fc8cd67ef888a76636a8b6fcbfeb62a8a6835a76d2c7529dafa2c0c1e6e5a9e8f

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e78b3e028cb4f53c2615ffa464e67e7d

SHA1
56c94a31911dfcd4bde2a4c609d2a813b4baf1ee

SHA256
72dd7470af3b41f909b4232ff954cc19b8e382e510d06237d48e784bc6e43be8

SHA512
a90eb9f749da04df6888ff9c1c93815d9e7ede0d00382db91f51a3bc15a1dcd48784f20608ffa5328db68c83cb16ccb067992bddfb5fb5cdf4e6276a7c21b1c0

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2359d39f6358d55eb1f42a16e7f9d90f

SHA1
8b752a9e68f15d65b6d7e7eb2640634000fd99aa

SHA256
ec19562d6a61c7c49e4d9bbbd7315c10669c2bc1702d3381d619696be5559c1e

SHA512
164dd071c33d337d654a6c68069b1119667cbf15c19fc6b45bc8e6bcb592375a668ce70d097e39f213b08e7abf16da60c7e89ac8934349256ff3a1fbcc0c69dc

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a0739216fee888b5df098fd0cde2789

SHA1
d8dc3eff7b238fd3f49cf45e0f1e04ba8cf3fb9c

SHA256
49ba8896d2fe54bb40c789e7dfb1437b04b6820c87b1c7a90d2ea36a131d0901

SHA512
ac0c2a1accbfb9d0a196eccf485c191aa30ad9eab4423be17f8e282b5d77a51811735191e4de6759f40f714d942cea9bb883519a8060a134ed7e7402d15ba3ee

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2964b902fb37f1f2164edc068ccca7ce

SHA1
ab68b085a6dad2c6aa8d7c0d85d41bfdbc1022bc

SHA256
9ca07ac6b58c9a2ad227b5e2016cf2e5180a42a2193aa2986154cb6411c3c955

SHA512
0b50087900d189d3f5ad17161b405a24f3d523123a3ef531a4a033ae0fca696e47980e6825d8c76c0bd5600c659ce4cc2ed0602d9488eb2e07e33643a84e3fd9

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e268ba8e253dc2133bc1cdd7278c317

SHA1
043f537878177ee32d7460d7a747b4a8fd90d7fc

SHA256
df4ff12ec093f15b3d0373e5956a62584641363b4645e2f9d5e7199e578fb6da

SHA512
f3f2c16f15485e23f3d7d3d3c9dacd846d4d959fd3744b8390395b725df5a8b9f2abba7b8ff1f443629b1468b8a30b6c764c1bc09f2193649db39bbc5c61811e

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab5880c2d8cfe6762607fd27325c4705

SHA1
ff7f16f26afe04ae677f6f5fa103b9adab2e25d2

SHA256
e0e410565a2f18d3f9784fc50dc8957c14f723c227fbe01594ffabdb384b9961

SHA512
7043375f1fb7590b756bf3deaf493a9a82496ba25503edfb674928acbb7b704ea94849e546a15a6c4c69107a7d26adff1814b065c3cf9c0a9d0f5ad335fa48e5

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a029bf8444af08386d19a8aacd027c7

SHA1
166ce787ed0f636695a0b600dd4c73719646cfe0

SHA256
03cc8b10e0304a9b5f2c0da73f581ce4c6eea8a96e88fcdfd499b21309282b1a

SHA512
1fb2b88d201ef875c1224b32ba580ce27a535a0a0699e6d64f5fd0c3e2ba4be8365a3c56aa08bf5eae0365923364558666157e9aaaef1ad67d798b243184c864

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e78e219d16253a53598f09bba6ad0bba

SHA1
7084d342846b572911e6ddfaee2debef345e016c

SHA256
b4a18a1332f4d7576d30a04981de63326d44c267695c26793b19b9eaf3c04113

SHA512
c5d7e5b1a81e3be6bac6b05fb6d7ad6df54dc29b4620c48a874852651f32056ded187ab9a12e57b259cb5fe546cc77c83db7eeabfa3b29dc4d8191783b361bd0

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
726b12aa316e935fb088691c2d487f36

SHA1
fb3acdbb3dd2592e1083560ebf32f12b6de21bc5

SHA256
1b63768ab3b23b861f1a95feb15a225799911062f442670556050d3209f00789

SHA512
420b8a04836f851c489b6c60788e5840dbce146df96bef9de6316ff6262dddba1ffa37a54946e69c8cde5879b747e4d99f5d883bed9ebe7ab8b8f2c8d345f238

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d5af79fdd28b75f0930019b508c407cb

SHA1
a486160744670bb8c9afd889544dea56fa60ab1d

SHA256
df459f2453e4d9a7fbb88cbde3c1743538723105f6bb97cf61f1030230942c32

SHA512
e51ee22bce148a60ffa6a1266042371203477df52784dcc85a4f2f9f60b751d1cdb502574189ee3b2f2eb8806b76407317fd786200acfb8e2a48856f5289e811

Download Submit
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

Filesize
97B

MD5
45746b5317d380078febe04385b81405

SHA1
e6b9a47deab744c12125936c5e5abb3e07b87fe8

SHA256
a42b05c8ba93f4f590f5f367118f4850dff4f3ec3a4a5e1aecce87a9ae4d5511

SHA512
caf91351c5590922a9a3faa41f5ebc82b450208a486a7a1cee32c140c2290f8890bcdd216371cfe5135e5cc0cfeca323b1d3a09973cd415239b1f7959af28098

Download Submit
C:\Windows\System32\config\systemprofile\Favorites\Links\Suggested Sites.url

Filesize
236B

MD5
11cede0563d1d61930e433cd638d6419

SHA1
366b26547292482b871404b33930cefca8810dbd

SHA256
e3ab045d746a0821cfb0c34aee9f98ce658caab2c99841464c68d49ab2cd85d9

SHA512
d9a4cdd3d3970d1f3812f7b5d21bb9ae1f1347d0ddfe079a1b5ef15ec1367778056b64b865b21dd52692134771655461760db75309c78dc6f372cc4d0ab7c752

Download Submit
C:\Windows\System32\config\systemprofile\Favorites\Links\Suggested Sites.url

Filesize
129B

MD5
2578ef0db08f1e1e7578068186a1be0f

SHA1
87dca2f554fa51a98726f0a7a9ac0120be0c4572

SHA256
bdc63d9fd191114227a6e0ac32aaf4de85b91fc602fcb8555c0f3816ac8620b3

SHA512
b42be0e6f438362d107f0f3a7e4809753cf3491ab15145f9ffa4def413606243f4dfffc0449687bd1bb01c653e9339e26b97c286382743d14a2f0ed52e72f7ee

Download Submit
C:\Windows\System32\config\systemprofile\Favorites\Links\desktop.ini

Filesize
80B

MD5
3c106f431417240da12fd827323b7724

SHA1
2345cc77576f666b812b55ea7420b8d2c4d2a0b5

SHA256
e469ed17b4b54595b335dc51817a52b81fcf13aad7b7b994626f84ec097c5d57

SHA512
c7391b6b9c4e00494910303e8a6c4dca5a5fc0c461047ef95e3be1c8764928af344a29e2e7c92819174894b51ae0e69b5e11a9dc7cb093f984553d34d5e737bb

Download Submit
C:\Windows\System32\config\systemprofile\Favorites\desktop.ini

Filesize
402B

MD5
881dfac93652edb0a8228029ba92d0f5

SHA1
5b317253a63fecb167bf07befa05c5ed09c4ccea

SHA256
a45e345556901cd98b9bf8700b2a263f1da2b2e53dbdf69b9e6cfab6e0bd3464

SHA512
592b24deb837d6b82c692da781b8a69d9fa20bbaa3041d6c651839e72f45ac075a86cb967ea2df08fa0635ae28d6064a900f5d15180b9037bb8ba02f9e8e1810

Download Submit
C:\Windows\Temp\Cab6934.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\Tar6937.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\Temp\Tar6AE4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Windows\Temp\www5C82.tmp

Filesize
195B

MD5
a1fd5255ed62e10721ac426cd139aa83

SHA1
98a11bdd942bb66e9c829ae0685239212e966b9e

SHA256
d3b6eea852bacee54fbf4f3d77c6ec6d198bd59258968528a0231589f01b32f4

SHA512
51399b4eac1883f0e52279f6b9943d5a626de378105cadff2b3c17473edf0835d67437ae8e8d0e25e5d4b88f924fa3ac74d808123ec2b7f98eff1b248a1ab370

Download Submit
C:\Windows\Temp\www5C83.tmp

Filesize
216B

MD5
2ce792bc1394673282b741a25d6148a2

SHA1
5835c389ea0f0c1423fa26f98b84a875a11d19b1

SHA256
992031e95ad1e0f4305479e8d132c1ff14ed0eb913da33f23c576cd89f14fa48

SHA512
cdcc4d9967570018ec7dc3d825ff96b4817fecfbd424d30b74ba9ab6cc16cb035434f680b3d035f7959ceb0cc9e3c56f8dc78b06adb1dd2289930cc9acc87749

Download Submit
C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b6c5ddf808f4ed006ce331ea09a5721

SHA1
2f953c3f624ea91fa19f57a2cff05a3a7f39f37d

SHA256
aaf9ac254eebb337223ae11888514911f004347595d4c68253a7ce4f19b2ded4

SHA512
49e12cd2e97654f55b6706e75bc4cf627048e59596cffbf626c4e0c52f3604f116526b9a8aa996a7f046791f10172f6ebbb3b410a16335a6ce3d16b16f23b4ba

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{50AA49A1-B632-11EF-9D33-D6FE44FD4752}.dat

Filesize
4KB

MD5
a224d168a4d0130cfc9753660e317ad8

SHA1
12d1ebeb79e823db52cf9f3151015784bd4d8097

SHA256
79ffa5f7f23dfda7ce0e1d976286cd9c3b3dbe23cd7831756566609b25f16778

SHA512
93e176cf2f4d089eea34bd21f01bdb06847224a6f106a60f9ab65e70af8772a9fe1c7343e8da379244c91f9b25adaea9d920f05d0cfba98f2af247e4209a4c69

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{50ACAB01-B632-11EF-9D33-D6FE44FD4752}.dat

Filesize
5KB

MD5
aed088e24664b3e23eb340d1770747c3

SHA1
8e2843d4e39f4842e991b404710be1a76050bea0

SHA256
fd9ef5ed10b478e4fd7e107f0e205f513d3e9767be68ec55524cd131aa5f3649

SHA512
8332400d67013ef1b8afb3c7cde9043f5543018e5e8e7d87c5ac543c649f52cf9d15bd90e95b4cd4e46a6fbb6e9640a1dd25f76ae9dd0a76ed3b921da5cc8cdc

Download Submit
C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk

Filesize
1KB

MD5
5b9bc134c5708b7391281f1d3465d06f

SHA1
9859a60f53ef25a32f0affbb36ed2ba2152c5c6f

SHA256
44c22674d00e8662d2898d17a7d0fafce37cf268476690070eebcd1460b00497

SHA512
6836425642007270ef4d688f8a65591368470a0ae618af248a503af6fdd8ac6e29fde0aff2991c75cb15f37585198f6941ae643bb8652ac72f1d4de87f949309

Download Submit
\Users\Admin\AppData\Local\Temp\d9ddeb1469426da75f9be466fd7f633b_JaffaCakes118mgr.exe

Filesize
132KB

MD5
ebc35bf5774a4b75cd45638cecb74db3

SHA1
3a4858d3ab2074b6d2d5a999a7443c683af2417b

SHA256
52c970b575040b26c6c357f1aa64288544578a229b9be70acd0f860f55cca346

SHA512
365feb8dccdbf66ff9dd5e1aa08126b0c6da0cb1fe6cf7a986cbb6c66928f7c3282492c11946598652e18fa695f7ea7021cd3f5943a20650e9efe829a0891ca1

Download Submit
memory/2168-0-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/2168-60-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/2168-10-0x00000000002F0000-0x000000000034D000-memory.dmp

Filesize
372KB

Download
memory/2168-9-0x00000000002F0000-0x000000000034D000-memory.dmp

Filesize
372KB

Download
memory/2660-16-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2660-11-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2660-14-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2660-13-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2660-12-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2660-15-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2660-17-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2660-357-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2892-32-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2892-33-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download
memory/2892-30-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2892-34-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/2892-31-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/2948-29-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download
memory/2948-1162-0x0000000000400000-0x00000000004C3000-memory.dmp

Filesize
780KB

Download