cerber | 27774522cc4848729069300e39654e834e34809f42821d0194ae1f81a412e52d

Analysis

max time kernel
18s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2024 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe
Size

189KB
MD5

fef9344ab43ca53984e45b9de42b07c1
SHA1

b816b11ebebcefb845a5ce52bef81d4ab6977174
SHA256

27774522cc4848729069300e39654e834e34809f42821d0194ae1f81a412e52d
SHA512

ca804be21964c00c6f1e6b6194a1db5515fba86d23ff3b38afc142140e4199d76bfae1e3f420a07f014082026df9532a3864a8b7bade636cad05984229c212d8
SSDEEP

3072:o/xkurCTnSOfXJv451a6ahso77pRoh8ottNZOUaWK1vbcHPjjPmxrJTLftFc5zEv:o/uTZFua6af77e7Z69lbxrJXKgaTJO5

Score

10^/10

cerber discovery persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Roaming\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note

C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great! You have turned to be a part of a big community #Cerber+Rans0mware. ######################################################################### !!! If you are reading this message it means the software !!! "Cerber Rans0mware" has been removed from your computer. ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1 | | 2. http://52uo5k3t73ypjije.hlu8yz.top/9A6B-0529-7108-006D-F6C1 | | 3. http://52uo5k3t73ypjije.thyx30.top/9A6B-0529-7108-006D-F6C1 | | 4. http://52uo5k3t73ypjije.h079j8.top/9A6B-0529-7108-006D-F6C1 | | 5. http://52uo5k3t73ypjije.onion.to/9A6B-0529-7108-006D-F6C1 |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1 appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://52uo5k3t73ypjije.onion/9A6B-0529-7108-006D-F6C1 | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.

URLs

http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1

http://52uo5k3t73ypjije.hlu8yz.top/9A6B-0529-7108-006D-F6C1

http://52uo5k3t73ypjije.thyx30.top/9A6B-0529-7108-006D-F6C1

http://52uo5k3t73ypjije.h079j8.top/9A6B-0529-7108-006D-F6C1

http://52uo5k3t73ypjije.onion.to/9A6B-0529-7108-006D-F6C1

http://52uo5k3t73ypjije.onion/9A6B-0529-7108-006D-F6C1

Extracted

Path

C:\Recovery\WindowsRE\# DECRYPT MY FILES #.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Cerber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .tor { padding: 10px 0; text-align: center; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R   R A N S O M W A R E</h3> <hr> Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. <hr> If you are reading this message it means the software "Cerber Rans0mware" has been removed from your computer. <hr> <h3>What is encryption?</h3> Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. <hr> <h3>Everything is clear for me but what should I do?</h3> The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. Any attempts to get back your files with the third-party tools can be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. <hr> There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already. <hr> For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. <hr> <div class="info"> There is a list of temporary addresses to go on your personal page below: <ol> <li><a href="http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1" target="_blank">http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1</a></li> <li><a href="http://52uo5k3t73ypjije.hlu8yz.top/9A6B-0529-7108-006D-F6C1" target="_blank">http://52uo5k3t73ypjije.hlu8yz.top/9A6B-0529-7108-006D-F6C1</a></li> <li><a href="http://52uo5k3t73ypjije.thyx30.top/9A6B-0529-7108-006D-F6C1" target="_blank">http://52uo5k3t73ypjije.thyx30.top/9A6B-0529-7108-006D-F6C1</a></li> <li><a href="http://52uo5k3t73ypjije.h079j8.top/9A6B-0529-7108-006D-F6C1" target="_blank">http://52uo5k3t73ypjije.h079j8.top/9A6B-0529-7108-006D-F6C1</a></li> <li><a href="http://52uo5k3t73ypjije.onion.to/9A6B-0529-7108-006D-F6C1" target="_blank">http://52uo5k3t73ypjije.onion.to/9A6B-0529-7108-006D-F6C1</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): <ol> <li>take a look at the first address (in this case it is <a href="http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1" target="_blank">http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address <a href="http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1" target="_blank">http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: <ol> <li>click the left mouse button on the first address (in this case it is <a href="http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1" target="_blank">http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> If for some reason the site cannot be opened check the connection to the Internet. <hr> Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address http://52uo5k3t73ypjije.onion/9A6B-0529-7108-006D-F6C1 in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. <hr> <h3>Additional information:</h3> You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. <hr> Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. <hr> If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. <hr> Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files. </div> </body> </html>

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Cerber family
cerber

Adds policy Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run = "\"C:\\Users\\Admin\\AppData\\Roaming\\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\\ByteCodeGenerator.exe\""	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe

Contacts a large (526) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ByteCodeGenerator.lnk	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2420	ByteCodeGenerator.exe

Loads dropped DLL 4 IoCs

pid	Process
2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe
2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe
2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe
2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ByteCodeGenerator = "\"C:\\Users\\Admin\\AppData\\Roaming\\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\\ByteCodeGenerator.exe\""	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ByteCodeGenerator = "\"C:\\Users\\Admin\\AppData\\Roaming\\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\\ByteCodeGenerator.exe\""	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
34	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2500 set thread context of 4696	2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe	82

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1308	cmd.exe
4800	PING.EXE
4992	cmd.exe
4828	PING.EXE

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023cb8-46.dat	nsis_installer_1
behavioral2/files/0x0007000000023cb8-46.dat	nsis_installer_2

Kills process with taskkill 2 IoCs

evasion

pid	Process
1788	taskkill.exe
3736	taskkill.exe

Modifies Control Panel 2 IoCs

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\Desktop\SCRNSAVE.EXE = "\"C:\\Users\\Admin\\AppData\\Roaming\\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\\ByteCodeGenerator.exe\""	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4800	PING.EXE
4828	PING.EXE

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 4696	2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe	82
PID 2500 wrote to memory of 4696	2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe	82
PID 2500 wrote to memory of 4696	2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe	82
PID 2500 wrote to memory of 4696	2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe	82
PID 2500 wrote to memory of 4696	2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe	82
PID 2500 wrote to memory of 4696	2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe	82
PID 2500 wrote to memory of 4696	2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe	82
PID 2500 wrote to memory of 4696	2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe	82
PID 2500 wrote to memory of 4696	2500	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe	82
PID 4696 wrote to memory of 2420	4696	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe	87
PID 4696 wrote to memory of 2420	4696	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe	87
PID 4696 wrote to memory of 2420	4696	fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe	87

C:\Users\Admin\AppData\Local\Temp\fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe"
  2⤵
  - Adds policy Run key to start application
  - Drops startup file
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Users\Admin\AppData\Roaming\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\ByteCodeGenerator.exe
    "C:\Users\Admin\AppData\Roaming\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\ByteCodeGenerator.exe"
    3⤵
    - Executes dropped EXE
    PID:2420
  - - C:\Users\Admin\AppData\Roaming\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\ByteCodeGenerator.exe
      "C:\Users\Admin\AppData\Roaming\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\ByteCodeGenerator.exe"
      4⤵
      PID:4532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        5⤵
        
        PID:4684
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbbcb46f8,0x7fffbbcb4708,0x7fffbbcb4718
        6⤵
        
        PID:1572
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2508 /prefetch:2
        6⤵
        
        PID:4716
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2560 /prefetch:3
        6⤵
        
        PID:4392
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
        6⤵
        
        PID:2488
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
        6⤵
        
        PID:1508
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
        6⤵
        
        PID:1944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
        6⤵
        
        PID:4660
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
        6⤵
        
        PID:2800
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
        6⤵
        
        PID:5004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
        6⤵
        
        PID:4444
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
        6⤵
        
        PID:2544
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
        6⤵
        
        PID:5000
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
        6⤵
        
        PID:4276
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
        6⤵
        
        PID:4956
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
        6⤵
        
        PID:3248
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2492,12320505542361399074,8067408143602408494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2456 /prefetch:1
        6⤵
        
        PID:1636
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        5⤵
        
        PID:1952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://52uo5k3t73ypjije.b7mciu.top/9A6B-0529-7108-006D-F6C1?auto
        5⤵
        
        PID:824
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x38,0x108,0x7fffbbcb46f8,0x7fffbbcb4708,0x7fffbbcb4718
        6⤵
        
        PID:2348
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
        5⤵
        
        PID:2044
    - - C:\Windows\system32\cmd.exe
        
        /d /c taskkill /t /f /im "ByteCodeGenerator.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\ByteCodeGenerator.exe" > NUL
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4992
      - C:\Windows\system32\taskkill.exe
        
        taskkill /t /f /im "ByteCodeGenerator.exe"
        6⤵
        Kills process with taskkill
        
        PID:1788
      - C:\Windows\system32\PING.EXE
        
        ping -n 1 127.0.0.1
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4828
- - C:\Windows\SysWOW64\cmd.exe
    /d /c taskkill /t /f /im "fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe" > NUL
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:1308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /t /f /im "fef9344ab43ca53984e45b9de42b07c1_JaffaCakes118.exe"
      4⤵
      Kills process with taskkill
      PID:3736
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 1 127.0.0.1
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4800

C:\Users\Admin\AppData\Roaming\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\ByteCodeGenerator.exe
C:\Users\Admin\AppData\Roaming\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\ByteCodeGenerator.exe
1⤵
PID:4432
- C:\Users\Admin\AppData\Roaming\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\ByteCodeGenerator.exe
  C:\Users\Admin\AppData\Roaming\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\ByteCodeGenerator.exe
  2⤵
  PID:696

C:\Users\Admin\AppData\Roaming\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\ByteCodeGenerator.exe
C:\Users\Admin\AppData\Roaming\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\ByteCodeGenerator.exe
1⤵
PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x344 0x4e0
1⤵
PID:164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Recovery\WindowsRE\# DECRYPT MY FILES #.html

Filesize
12KB

MD5
bc5fc7318985109d0938f5b2ec11947c

SHA1
2a7ca11a015c8d8d730846520ddbbf78978b42cc

SHA256
9261147fb4c11c2c450ea25e0f693cf877bd6bb6889f25b3edf7d7bc48c939c2

SHA512
ff2672f0b5fa7369bed7a99177bd97ed7a46a0a7a9f25c955a807e4237627e9707643ed0d520775ff628a15b0e51134c647bd16473a453571f904ddb783cb504

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
02adde5c6d4421100f1e21c2f6f7dd16

SHA1
4dfb5ec623fdd68611698cd9232bcb78ab8586f3

SHA256
edc251b48cdc40370c699e320e8d6ede56de7cb84cc7f6b3d554a52b98b0a982

SHA512
254f0b28928f7285500fedbbead0d0f69224c080bb995abc6ad2d86aa395ad189740b2838da909e2b7b729a3a05ee5556900d410e33597ded07258cbe854262d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a50ae343-09f3-4487-a4e3-48010af7ddee.tmp

Filesize
5KB

MD5
5683df009c99c8090c8effe658eda3a8

SHA1
f96621794eca08bf1d5bea52c40a02691def33fd

SHA256
f3f8dbb9d3b3bff8e493885ed0262ba197bbdf7c236e126f8e27b754ca1b9ed1

SHA512
c0e1b13df585758154ffd3c61078d6e0eabe7697cc903639b2d6c7731149147d0d79e7cc74dd067cb0f22eed13838e07fc5a6d07d1f82b14529a2f90df499b55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
422f86dd72136b9e7d1450ec975c9065

SHA1
1ac135f14cff3b3c642be9983f7f15aa1e308e57

SHA256
f3a0bef8fdc778cbaa504226d2918b3dd3e2ea3a61efab4e7a756ec3381ee5e0

SHA512
f5aacda396619fca51eab0b97cdf4fba150d296c8a1aa8593219ac6c2d3c1e3c9524402a5e5db18f08462a14e7b2eba066e49435d49a34da50837764e1a8e188

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsoDB20.tmp\System.dll

Filesize
11KB

MD5
6f5257c0b8c0ef4d440f4f4fce85fb1b

SHA1
b6ac111dfb0d1fc75ad09c56bde7830232395785

SHA256
b7ccb923387cc346731471b20fc3df1ead13ec8c2e3147353c71bb0bd59bc8b1

SHA512
a3cc27f1efb52fb8ecda54a7c36ada39cefeabb7b16f2112303ea463b0e1a4d745198d413eebb3551e012c84a20dcdf4359e511e51bc3f1a60b13f1e3bad1aa8

Download Submit
C:\Users\Admin\AppData\Roaming\# DECRYPT MY FILES #.txt

Filesize
10KB

MD5
2b9c19ebb90a4ef0a7093ce8e0bfda8e

SHA1
6441937097444a83d3b0426d1a7ec1305e9ff220

SHA256
4ebd88dc39c46c4aea5cc6a657ccee02c89f8e2c3a23816c489ce767a6c8c48a

SHA512
b01d001c5617b7de6d8c3a592f31b1b3e18c0a71535a0cbca939c123cb72e2493be4d2995751f8619ddd747ec4fe5846e563bc6e56184d95a5dacc524e22d10c

Download Submit
C:\Users\Admin\AppData\Roaming\# DECRYPT MY FILES #.url

Filesize
90B

MD5
9066348979b12f072fb921a71f042a93

SHA1
37b1d242760e612d9e56809bf0dcc5656d232e93

SHA256
9b9a49c8ae6b0d0d19960a040b81a5fb4847c64aae55dea54a160444b212c316

SHA512
5753c2ec857c14ec1294bc3e5f6116c065a1b49666512ad39b360932c3ff19e8e824ab707e62722b4e2da7e3dd1ec207f7ff967cb0cf807b0160dd51732b5829

Download Submit
C:\Users\Admin\AppData\Roaming\# DECRYPT MY FILES #.vbs

Filesize
234B

MD5
6f84dbf74ef41dc3d861f5fb3e0f45ff

SHA1
3e5f17e9b9589f33ce6add7f2518a666ff2253a4

SHA256
df5f432d7e0d2bd1c4dddb1fabbf1e77bd1065b9020f71abaf1a45fbb950bbb8

SHA512
9f9ec25b815be7b20df26244d31848c9a4896b130241b63636d63511a290eaad78d289a9bb04592c0ba31492064671351b4c7359310f03469e27764132a20a5a

Download Submit
C:\Users\Admin\AppData\Roaming\AsteroidVertexShaderInstanced.hlsl

Filesize
1KB

MD5
fe97ee17f001e5724ef103754fb32f7e

SHA1
b12ad571d8201d5584446c20df7302947b94ae5e

SHA256
c44863944bc085c1c8af13b0d22d79f44689c0dcaa19dfefcab8532906baf27c

SHA512
30cb641808fd1959915a0e1fbcf45da3be5630f1df0a859377737e9651bd56ab1fdf2d94594233f36a093ee74d919a102e3e2ae2a66947c109c9780ed31d10b2

Download Submit
C:\Users\Admin\AppData\Roaming\Bl CG10 WmG4 CG3.ADO

Filesize
524B

MD5
02710317e2ed8cff32667d51f5b66075

SHA1
4864ad2b003b38295a26301488366d5ab02ce546

SHA256
d0807c59413e8607b26eda3f20989ce2baaa57ed387e8754e050ac64df39230b

SHA512
698f08773b1cd7702a96dd5a0fd3dc5185abe070dabdc2c2907ab9968bf39cd2ad67ffdec778997e60e3785b56d0ec288b66cfe6a37bfa0f69f2a3be962a1c83

Download Submit
C:\Users\Admin\AppData\Roaming\Cenobite.mdC

Filesize
126KB

MD5
7371583b0b6e0103780f9679e260b16e

SHA1
532e0dc9a8974bb7b2e4a86bfa3c4903b68725b9

SHA256
38d4097752e305b798335ca41a0bd2727ff44065f80c8ddecdf99e2adc5af1da

SHA512
3b8e00435ba136d8d0eb44d4de31108a890f93fb324d620f249d3f3d17c8d4f44888577139a0ca46f11a1ac94b84b013db3c9cba1f7a11208db38a2ad04cd21b

Download Submit
C:\Users\Admin\AppData\Roaming\Cenobite.mdC

Filesize
126KB

MD5
22ecb073f20fa7aaa0632df14f5413e2

SHA1
f4357bd1101d63c09c8ae615760e0ed6457ba1b9

SHA256
e15fb74281f181b806253b61bd416ff02b534732bf39c1d01d540ec7a33ccb2e

SHA512
2837f49a675a2ab5c703ea387a905894a96961aa4f17ad3ebc3f0c85b95cc8c4ce45681e30da5aef1f7d27d95d7607197d7da05006e813953e8ce978846d67c5

Download Submit
C:\Users\Admin\AppData\Roaming\Dawson_Creek

Filesize
509B

MD5
e48f88be96ebc26dbb0ffcc604997483

SHA1
99f857985e9eeb3e78b1d07ecf93701349a1772a

SHA256
71b97cc87cc10a413bd1ad45e5c131d99acd5053d7a326bbbc8e041b0b1c4926

SHA512
86221e10d4626779cda787e3b83e4d5f042660b6e5ea31f43c448fc831b0c6a26ea749699bb9676362984c6e798df1e6bd4a45b6897599e5e17d0efda8949ced

Download Submit
C:\Users\Admin\AppData\Roaming\Edge.mpl

Filesize
3KB

MD5
c2b143dc4ee1df5f628a40c06c9553a0

SHA1
01b6854f5204656b7d35681fb7ad871385a6cded

SHA256
001902229a1cf8b5774ced9a929320f9f3bbc7cd6ff44c692b317fdf68fbf93e

SHA512
8cd0cbe90f17a55b20d1a1a85254dc56322fda6ba5456eaa6a617936b10f724edb72dc490569f2b1b48cf8ba699c6a556b18d782a999d737e7f21553f5a4aa8f

Download Submit
C:\Users\Admin\AppData\Roaming\Fighter4 Flight Path.mesh

Filesize
3KB

MD5
c22dce2c95e3fbc8ac2f569b7fb8474a

SHA1
9e5b1c407424004fa5c0c1d96af96a9b0e10353e

SHA256
423cad4eca8206b5b3ef851278a749e5246042e32759abe6b2026d14ed2ba6d6

SHA512
f516531af2f75cb949ef6fbd2bd18e12aa07f94e2b7cb1398d0b13033f84c91f32ca28dc76c6e8caa8191c7b115a3cf59fddc241bfb3e244ae50247c6eee69f1

Download Submit
C:\Users\Admin\AppData\Roaming\Fiji

Filesize
588B

MD5
03eeedd6926392057b761444ea01871a

SHA1
e3cc8ce79e0625854e1f922ebbe4ba2f44d0248c

SHA256
ba6662dd53b64810a0449f9ff4a9ca3a46f2d5ad63ba66507d00988b64bc043e

SHA512
c8516e29e3b8a2b9d9f8e43d472cd4d4af6393f5be2cbe59ee6422f7238a3bfb7523c821d9ed1de25136f58905af54b724528e80562f20e2f250927851b17968

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\ByteCodeGenerator.lnk

Filesize
1KB

MD5
d4b0e2e2f96bdd13af8d3602b925eef0

SHA1
0636cd9e8a81a5e716b53255b9f0afd10f084028

SHA256
4cf3c603c1163c488fad45f3bfc9899f4bab0f3f0c52bf6a771295de13535443

SHA512
b7d0523456348979b7a9b34524c77a2a1c23b1ccda88b5d91586ba15266c4fb1361507f9d267e4fd59528b99a31fe33be63b917a50cc30e547efda964cf46db4

Download Submit
C:\Users\Admin\AppData\Roaming\Perl.dll

Filesize
48KB

MD5
d850fbd4283334bc6a8214cdee231e05

SHA1
164dd2e14e242de3270f2a768d36b729d56e33b4

SHA256
e67206ab8bd532b15621cc99c6ea8588e567b4b8b2211ed020ba6d25c166fe1e

SHA512
50986b5185b363d0a6b674bb3cd9db4308f2bdcfc4e36eb381a770cbafa6401c96a17e0c6f50a4da0afaabe9d08209547aadd5fa2b165e1346fd6d63a33d3fc4

Download Submit
C:\Users\Admin\AppData\Roaming\ai.js

Filesize
4KB

MD5
a02394f8f25479ed529c5985951740c8

SHA1
2721f2ca6d3a943015968eb19b2276af9c01a8b3

SHA256
6955aebcd757be32733285604886270e0bd77a2b0c2ce91531b5a17fb0658c06

SHA512
2dd6c075877b50e6c7e5f778ace158814e34065844b13437eb0b9a34d7f6365bebea8a3964a44a83373465d28063ecc1ad665fe8d1ba86a0454e6ba0b78d3ad7

Download Submit
C:\Users\Admin\AppData\Roaming\alert.jsx

Filesize
765B

MD5
b78fded48dc97b8ed5a456e9889be8c8

SHA1
2ca874bda004a87b0b0b62fc4e5125378d7070e7

SHA256
79e83de442ac0d00e464785d9c9293e2c88ee98a176b304b01857231c603868e

SHA512
0b00eb7d3f96435ea0c58d7ad6c59d5e59f9a7e408259e72c79e4dc05364d733ca239c2f44e6343f7fa8da7ec2a04ab144428adda01cc8586b89335e8a3aaf31

Download Submit
C:\Users\Admin\AppData\Roaming\arrow.png

Filesize
826B

MD5
d0b4c9740f9346823e21d7dfc5bd9f1b

SHA1
019c25a3c797e9bd3c526c73698077ba703712de

SHA256
e634695e0e798533dba1ffb41062867c6a43f10393ac0482ac64a5c8eecd6013

SHA512
1979573472b0a010f1c7988427a09872dce90a9b9652396c65a45eb26a2a27838369467d1b5f34411f74c1b216b2e70b000d7decf0e04fcad17650d6a1fa07d0

Download Submit
C:\Users\Admin\AppData\Roaming\arrow.png

Filesize
1KB

MD5
614e7e08cf0eeea14950e992d2cd39a4

SHA1
d56e2815c16ef5724d61e783fa8d04da602280c1

SHA256
a0a1aad282f4ed0bfd1e6d9d1361c32d57c58907bc8a4eea323ad9b39478f37e

SHA512
692d497756c95cf0e21feafbdf4f10aa441fed0713a2d725a3cb14dec45ff47868a928cf4e3f15b2185e61293104dad6dd0e64ee432e6a27552672d52dcf876f

Download Submit
C:\Users\Admin\AppData\Roaming\axf.xsl

Filesize
3KB

MD5
3e6bfa45474395fcab8c295d63fe0ca1

SHA1
532af3f2b90b3b1cbc7fd7401777ae271aff5f74

SHA256
973a3d4fd3db35ef04dcd3b99176f9df936f4729b1880c189f39507e97ba8732

SHA512
058551c718aeff1749dbac4a6d02ff540a8e29c13a9b15ddaaae64afad0fc78b4a91805a69aa210b7c3f14df31ecf539b866fea276bad9dfb2a05a06c702c653

Download Submit
C:\Users\Admin\AppData\Roaming\dell_connect.png

Filesize
973B

MD5
913b810d2dcddc96c9912db515e52b06

SHA1
4f519525e5d42017a0b4b63efee0dae535463955

SHA256
d7cc49ae4e62c48a5d9d4c6626020c6e439d261eaaa17719f9c2d8b269b89fd3

SHA512
41f0d4a7fc8a2cc17d14fe66bc164bde8058c3420b907d4d54aeadda170a44b72cea89923988c0e74f0a40bc233517fb020caea0a0dd3db79e291a648ef58dce

Download Submit
C:\Users\Admin\AppData\Roaming\dell_connect.png

Filesize
579B

MD5
9d4ccffd63ccbfa1ebab9328c85bdbdd

SHA1
3c3e8ea7850acc45d4c03e888e7db4bb743d757e

SHA256
04344cffe2ee8caa003981ca6941c23730a3e6a27ed6bc7a1bb3add804ed04a8

SHA512
4291e48c7501591dc3f9e4746c6f852702365698c7c2b34bf9f09565a963a2809ad66161c4da348c0dae51128906c577056bd5bba3b066a92a704359fe055c81

Download Submit
C:\Users\Admin\AppData\Roaming\eclipse.autolabel.xml

Filesize
1KB

MD5
319191ad15159427d11c8bda7669c1f5

SHA1
e302d215f6f2858671d88f061f5c3d3d245a7335

SHA256
84b5f88a75bc33689c7e07f04e30ece39947a8d24953c1934000d5fed32424d0

SHA512
cbcfabccf81932b9d8cd66812c6dc7551863b2a39bf2330363b2fc48d87b1bea12e9878d9a4f863a5289db6bd79187b3c4fe59f6161c11ac7e741404cfa1f240

Download Submit
C:\Users\Admin\AppData\Roaming\eclipse.autolabel.xml

Filesize
952B

MD5
19666991fea55b6ce99dcecf85ce420b

SHA1
2511d4fbfff7c777a1f648bbdb49e68e47b39b94

SHA256
362d8efc2b18b4eadd65be44ce7bf25d28e2e17b58f109bb724c2c68517e33c9

SHA512
11804caa55ef65220c21f3d5ef85f0853a7199d205b20e415c5d88370f2fabd1608b8dc30e9d5b19a1e003c2e8f5ea91bec9227b77dc0b4e39dbc7fb3b68d19a

Download Submit
C:\Users\Admin\AppData\Roaming\frn.fca

Filesize
1KB

MD5
420be751ebc4ba1db0066cd8abdcd653

SHA1
1f046369b9e98c4efa5e342b479d32843467197b

SHA256
5bbd13fa185a62a97a1eeece5278d87f68333bc22e8aab0c26d10dd17a0b1070

SHA512
f8715e5d71570f5d7b81e9bc39efe28de97ecbaa5782559644562da1875adea3ef4693d142378332cfc412077f8530fb9755efa0e98e215e572eae714fc04200

Download Submit
C:\Users\Admin\AppData\Roaming\g2_Letter 8.5 x 11 in 300 dpi.IMZ

Filesize
46B

MD5
633d34ead61d11ef8028e7ae3f22f062

SHA1
964f641288254491cf203ad9966e145ae04750af

SHA256
2798675ce2702d03c99a831e3794f40d08271ccf74856383c41601aa0dd6f502

SHA512
65dfbd479b5eb7294899d503440997172e0fc00754e12caf56a26cbd58fa5502351abd8a1970ac132ad3ca55982dec3a231acfd0031232246386dc484c8e5956

Download Submit
C:\Users\Admin\AppData\Roaming\generate.id.attributes.xml

Filesize
2KB

MD5
9c9a95e738765fc608d7c4e76b2f35cb

SHA1
9dc240f7154d9aaf682906a987f141b3dd4be7e0

SHA256
3c33893b88336ee1a3b8371c05ce32b51010b5ec73f67af002d53ca66174534c

SHA512
aab54fde37e68017852729846f7fd77db36bd38ba20ad2991ae95c534fa85c518e1d837c308db87c88412877eb5742555f512053b537b16d032d291cc3cc01d1

Download Submit
C:\Users\Admin\AppData\Roaming\goURL_lr_photoshop_de.csv

Filesize
518B

MD5
831f0622bf83e0f5106b5db122509ce0

SHA1
447d87d4ce42640f851cb9bae81dd09937bcb090

SHA256
6668dbf76737d19a74b9ca9d44e876c495aecd253bd5f62dbad13691dfc1ba6b

SHA512
36ecc5f60d4c0ae4f8e83947d88e5e2fa89802f4b10cb602fc5e83fec7c403d30b9c74df73fd87aa2d772a2eb78cdaaf1f323d7d6210607ee026ceef18783e76

Download Submit
C:\Users\Admin\AppData\Roaming\paresthesia.cxs

Filesize
63KB

MD5
3e11d432933fadcdfb3fb46a980890d8

SHA1
87de2600ded2c78c5e5c418abd1f492ecda015cf

SHA256
d104e85873c2648f0e7a9575412e0404d97dddb258dbf67dff7efe8b91c1544e

SHA512
dc315b9fa5a06c86cff5eccc91395044aa09f4b8c3c2a475d3940150023d725e5d2e9345ad5d43f9413c18e1f5b02c58f4a3864e910637ec6214f113c68964be

Download Submit
C:\Users\Admin\AppData\Roaming\paresthesia.gnr

Filesize
62KB

MD5
7316ffd8413fdf2934837736a562ca8f

SHA1
ad2be838259510ba2a626c414b2fd419b6f5bdd6

SHA256
86361d15a3ee2a09e80518c4af5f67c2eced91c3c7b19410b62c5120130736cc

SHA512
28ac9fc27f1c54f79f8155524188c2ee7afa473e82c6b4bde8e227346c7c35e6b11e42090ab88c0ea6cc01822b6685e80daf31c10958164f60404af1198ba39b

Download Submit
C:\Users\Admin\AppData\Roaming\{C911B2AA-596C-4108-AAF3-1A9B368B3E1D}\ByteCodeGenerator.exe

Filesize
189KB

MD5
fef9344ab43ca53984e45b9de42b07c1

SHA1
b816b11ebebcefb845a5ce52bef81d4ab6977174

SHA256
27774522cc4848729069300e39654e834e34809f42821d0194ae1f81a412e52d

SHA512
ca804be21964c00c6f1e6b6194a1db5515fba86d23ff3b38afc142140e4199d76bfae1e3f420a07f014082026df9532a3864a8b7bade636cad05984229c212d8

Download Submit
memory/696-179-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/696-178-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/2420-106-0x0000000002220000-0x000000000222C000-memory.dmp

Filesize
48KB

Download
memory/2500-33-0x0000000027900000-0x000000002790C000-memory.dmp

Filesize
48KB

Download
memory/4432-172-0x0000000002260000-0x000000000226C000-memory.dmp

Filesize
48KB

Download
memory/4532-511-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-505-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-184-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-175-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-187-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-186-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-113-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-508-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-516-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-490-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-527-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-533-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-530-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-524-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-520-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-515-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-157-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-185-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-522-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-487-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-502-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-499-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-496-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-493-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-115-0x0000000003740000-0x0000000003741000-memory.dmp

Filesize
4KB

Download
memory/4532-112-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-111-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4532-592-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4696-41-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4696-39-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4696-40-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4696-49-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4696-38-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4696-36-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads