zeppelin | 43812b98e4f9480d25b426a23a7b4d2a4e498110545c7a3cb21159bf75c18e7b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-12-2024 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe
Size

406KB
MD5

de904e0d5b71c0c3d99430b61d40aae2
SHA1

5e1add3f70404f2110c389674e481484365eead4
SHA256

43812b98e4f9480d25b426a23a7b4d2a4e498110545c7a3cb21159bf75c18e7b
SHA512

25f086b82e86fcef30474d13e723980f43fccdd473b0e3f556b78b434494c2b22a3e3b765fbf2647aeb030e814a1eea1fdfe6d35e894449880780d6f3732d3f0
SSDEEP

6144:Zmr7jJUEMBNUNwxJ6m16i6d+W+u7Qn7prLtSacoTccdk+Hy:ZyfJcLUNMu7Qn7prLQQTccrS

Score

10^/10

zeppelin discovery persistence ransomware

Malware Config

Signatures

Detects Zeppelin payload 7 IoCs

resource	yara_rule
behavioral1/memory/2360-2-0x0000000000400000-0x0000000000544000-memory.dmp	family_zeppelin
behavioral1/memory/2360-70-0x0000000000400000-0x000000000054B000-memory.dmp	family_zeppelin
behavioral1/memory/2360-78-0x0000000000400000-0x0000000000544000-memory.dmp	family_zeppelin
behavioral1/memory/2568-79-0x0000000000400000-0x0000000000544000-memory.dmp	family_zeppelin
behavioral1/memory/2568-111-0x0000000000400000-0x000000000054B000-memory.dmp	family_zeppelin
behavioral1/memory/2568-113-0x0000000000400000-0x0000000000544000-memory.dmp	family_zeppelin
behavioral1/memory/2568-112-0x0000000000400000-0x000000000054B000-memory.dmp	family_zeppelin

Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
ransomware zeppelin
Zeppelin family
zeppelin

Deletes itself 1 IoCs

pid	Process
1512	notepad.exe

Executes dropped EXE 1 IoCs

pid	Process
2568	services.exe

Loads dropped DLL 2 IoCs

pid	Process
2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe
2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\services.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\services.exe\" -start"	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	services.exe
File opened (read-only)	\??\K:	services.exe
File opened (read-only)	\??\Z:	services.exe
File opened (read-only)	\??\V:	services.exe
File opened (read-only)	\??\U:	services.exe
File opened (read-only)	\??\P:	services.exe
File opened (read-only)	\??\H:	services.exe
File opened (read-only)	\??\B:	services.exe
File opened (read-only)	\??\R:	services.exe
File opened (read-only)	\??\M:	services.exe
File opened (read-only)	\??\L:	services.exe
File opened (read-only)	\??\J:	services.exe
File opened (read-only)	\??\Y:	services.exe
File opened (read-only)	\??\W:	services.exe
File opened (read-only)	\??\S:	services.exe
File opened (read-only)	\??\N:	services.exe
File opened (read-only)	\??\I:	services.exe
File opened (read-only)	\??\G:	services.exe
File opened (read-only)	\??\E:	services.exe
File opened (read-only)	\??\A:	services.exe
File opened (read-only)	\??\X:	services.exe
File opened (read-only)	\??\T:	services.exe
File opened (read-only)	\??\Q:	services.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
17	iplogger.org
19	iplogger.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	geoiptool.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	services.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	services.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe
Token: SeDebugPrivilege	2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2568	2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2568	2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2568	2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe	32
PID 2360 wrote to memory of 2568	2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe	32
PID 2360 wrote to memory of 1512	2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe	33
PID 2360 wrote to memory of 1512	2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe	33
PID 2360 wrote to memory of 1512	2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe	33
PID 2360 wrote to memory of 1512	2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe	33
PID 2360 wrote to memory of 1512	2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe	33
PID 2360 wrote to memory of 1512	2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe	33
PID 2360 wrote to memory of 1512	2360	de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\de904e0d5b71c0c3d99430b61d40aae2_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe" -start
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:2568
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB

Filesize
2KB

MD5
3fd0150a8783351b705067e95b6a7a73

SHA1
f25ebe76c2199de815dd7a387377e489900b6199

SHA256
6cd1f27cc83e8b2f6f20308c3fdc89598eb29ea3a0e0e426a21094a309397a86

SHA512
178de8824ae3ad07348edadbde2805c3c24f2461aa540c46e5b8a4e29227e43a08f841deaf7bf49d7e24c1d4f29faf65f90c79304c52ee5bf8f85c9601f5e1ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78

Filesize
472B

MD5
f8c2ef375d65ea851dbec17c45ceaf80

SHA1
ee465722f65b62c4e2f4ca8a403c343efbac673e

SHA256
66875c31f25ecd20ff76967b7fceeff43ceff626d47fe28b99d18dd1fba6ae51

SHA512
2e1fc8dafc52ec52e1eed6c0e373964579e5b794eec27b9110c8df3410b5017b3f8e78d067c4811c39981152691362eff7829d996eea0ee10d586ef86f5de2ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
5890b835ebede7489e6738fbd7c5c26b

SHA1
ce5a010ff84e0145a4893525f760041abee69b60

SHA256
417ec3d4a4a821c255e6c2103883e0437a26310d8aa9bbcde058d85c20c2cc23

SHA512
5e0afee870a5de2756ef49c8b4e017b9898080effa80d4eadae9693d34c8284bb32c7eec9d23d273e83c3a57782a25f8e068f3fcb52efa4b3685b9ccb93112ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB

Filesize
484B

MD5
81298f09063ec226a4ad5a2c26e9a74e

SHA1
23d37fe8c4feef47abe740519c34467de2a71c04

SHA256
0513900b95c7981bd851cf2f9550008296c5ed866694452ea30576cf4aa11b02

SHA512
cc75fb2431f3f82cfad2b45ddc2285bc05e0f236484ae260a625b3cce3f0f3f5ab93b9b8de514e3fde44b73c3ecaca93b561ca808bd287208124247f606a27b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78

Filesize
488B

MD5
ccd2b39067408fe0cdc7e22b15cf60fb

SHA1
0479a231c536ea62f8157e3fd02cff24989bd317

SHA256
c9ce0b13eb36a5c131dba8bee12bd0e5f3e99010149053f3cf3a4d1624373893

SHA512
7720d4646874fda370ef8b3855913d6c4da261396ed27c012ff4444353952a53e6b4d14d7eec102ecfa0656caafd13f673441794f198d11dda325de552c03988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
985f1ed943a2be4401b1e506574bd881

SHA1
947ec32cd76e86ea1cbb8e1aff19ede8a340e00d

SHA256
06990ced2b60542b0d45433feb86ce9fbdf43ce62d8ca495545de57d98300244

SHA512
11a92fef895126e1a2854c52c20e7664fadbcb8c9b631e01804c9544691ade36a6339293e843ec719308db7ca79508970df36bdf2e173168ad6592924a9e8ef1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
f042fdc1a0672dc59bdcd2717d49d1fc

SHA1
4cf066f8179d291bd924061db5a32c113f479fdb

SHA256
4c6d43914a0e32de4eebcc824f461cd67efb804dac25a14806e8ef6b5d75f247

SHA512
ad6b1b13b2c3a41eb1ecf867ef1775cff31f9be09f4499e1be64b2356e416733748a5507e66c144dcec1cf9512a92b750ec8c9b210bd78226ca7e4862a661f53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7CNUR30T\SYM5L5NT.htm

Filesize
18KB

MD5
99a5ced9dfb5824225a0fab4c74a7b46

SHA1
f0ebed42f94fabe0c10dcf1eb3eb084a904e144a

SHA256
44b3cbfb57079b2570e5ae94942d8e00ce0291c26317c2649a41101018bab25a

SHA512
2966164e08f60aaa0078dbfee9f4d5521b5c02525dbbad4ac14df0d6be948ba98ae1da33e05ceec07abd6d8a18278c399629621803acdccc91019372fa3152ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M4TQDAHL\HQM0CDOE.htm

Filesize
190B

MD5
6ebbeb8c70d5f8ffc3fb501950468594

SHA1
c06e60a316e48f5c35d39bcf7ed7e6254957ac9e

SHA256
a563426e24d132cd87b70d9cb5cd3d57c2e1428873a3f3eb94649cf42e37b6a1

SHA512
75cfab1c9f5a05c892cf3b564aed06d351c6dc40048faea03ae163154ff7635252817d66b72a6ef51c4f895eebf7728f302df51148acce2a0c285502bf13652c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE2B3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE2E5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\services.exe

Filesize
406KB

MD5
de904e0d5b71c0c3d99430b61d40aae2

SHA1
5e1add3f70404f2110c389674e481484365eead4

SHA256
43812b98e4f9480d25b426a23a7b4d2a4e498110545c7a3cb21159bf75c18e7b

SHA512
25f086b82e86fcef30474d13e723980f43fccdd473b0e3f556b78b434494c2b22a3e3b765fbf2647aeb030e814a1eea1fdfe6d35e894449880780d6f3732d3f0

Download Submit
memory/1512-71-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1512-74-0x00000000000A0000-0x00000000000A1000-memory.dmp

Filesize
4KB

Download
memory/2360-2-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/2360-0-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2360-76-0x0000000001E20000-0x0000000001F64000-memory.dmp

Filesize
1.3MB

Download
memory/2360-70-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2360-69-0x0000000003D90000-0x0000000003EDB000-memory.dmp

Filesize
1.3MB

Download
memory/2360-78-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/2360-1-0x0000000001E20000-0x0000000001F64000-memory.dmp

Filesize
1.3MB

Download
memory/2568-75-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2568-77-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2568-79-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/2568-111-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download
memory/2568-113-0x0000000000400000-0x0000000000544000-memory.dmp

Filesize
1.3MB

Download
memory/2568-112-0x0000000000400000-0x000000000054B000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads