neshta | 44383243001cf4c3937016df8d0cc3f6b77147960df4f051d8feb8a455bb9d00

Analysis

max time kernel
95s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
01-01-2025 04:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
Size

194KB
MD5

46e61d1b5376dd6642a40e5465318410
SHA1

e0b20c3d8b9853db4027f7cc74014f66a26ae014
SHA256

44383243001cf4c3937016df8d0cc3f6b77147960df4f051d8feb8a455bb9d00
SHA512

de39df76dacdb7558aa49c603760cad74e57f7481a6c9de2acc3418c2d06cc584d72eced3cdb22c4014ddc878dd391be8e470e25ae15adf002a64e89ff6c04d8
SSDEEP

3072:sr85CY9X3tLBAMrAEi9/axmLBygElun9X3wuc5ig7CDMefRwgOZvD5vZvuCErCoi:k9OIERmLwlu9+irwg2vVvZvuCYX6bH

Score

10^/10

neshta defense_evasion discovery persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 41 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023c9f-44.dat	family_neshta
behavioral2/files/0x000400000002035f-111.dat	family_neshta
behavioral2/files/0x00010000000202c3-126.dat	family_neshta
behavioral2/files/0x0004000000020352-125.dat	family_neshta
behavioral2/files/0x000700000002029a-114.dat	family_neshta
behavioral2/files/0x0008000000020253-135.dat	family_neshta
behavioral2/files/0x00010000000225f4-142.dat	family_neshta
behavioral2/files/0x00010000000214f5-144.dat	family_neshta
behavioral2/files/0x00010000000214f4-143.dat	family_neshta
behavioral2/files/0x0001000000022f43-151.dat	family_neshta
behavioral2/files/0x0001000000022f47-150.dat	family_neshta
behavioral2/files/0x0001000000022f86-158.dat	family_neshta
behavioral2/files/0x00010000000167ca-170.dat	family_neshta
behavioral2/files/0x00010000000167c2-174.dat	family_neshta
behavioral2/files/0x000100000001dbc9-185.dat	family_neshta
behavioral2/files/0x000100000001dbb6-183.dat	family_neshta
behavioral2/files/0x000100000001691f-193.dat	family_neshta
behavioral2/files/0x0001000000022e82-201.dat	family_neshta
behavioral2/files/0x000100000001696d-198.dat	family_neshta
behavioral2/files/0x0001000000016916-192.dat	family_neshta
behavioral2/files/0x0001000000016910-191.dat	family_neshta
behavioral2/files/0x0001000000016914-190.dat	family_neshta
behavioral2/files/0x00020000000215eb-225.dat	family_neshta
behavioral2/files/0x0002000000000729-223.dat	family_neshta
behavioral2/files/0x000a00000001e7fa-241.dat	family_neshta
behavioral2/files/0x000b00000001ee17-240.dat	family_neshta
behavioral2/files/0x000500000001e8b7-239.dat	family_neshta
behavioral2/files/0x000b00000001e60a-238.dat	family_neshta
behavioral2/files/0x000e00000001f3d7-237.dat	family_neshta
behavioral2/files/0x000400000001e6a1-236.dat	family_neshta
behavioral2/files/0x000300000001e8be-235.dat	family_neshta
behavioral2/files/0x000300000001e86b-227.dat	family_neshta
behavioral2/files/0x000400000001e286-226.dat	family_neshta
behavioral2/memory/4476-242-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2856-244-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4476-245-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2856-247-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4476-248-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2856-250-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2856-252-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/4476-253-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe

Executes dropped EXE 2 IoCs

pid	Process
4680	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
2856	svchost.com

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Binary Proxy Execution: Rundll32 1 TTPs 2 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
2856	svchost.com
848	rundll32.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GO664E~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE	svchost.com
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\NOTIFI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\BHO\IE_TO_~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaws.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	svchost.com
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	svchost.com
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOBD5D~1.EXE	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~2.EXE	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\COOKIE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe

Drops file in Windows directory 48 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Cursors\Aero\SETB6F2.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB6F3.tmp	rundll32.exe
File created	C:\Windows\Cursors\Aero\SETB6F3.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_move.cur	rundll32.exe
File opened for modification	C:\Windows\svchost.com	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File created	C:\Windows\Cursors\Aero\SETB6EF.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB6F0.tmp	rundll32.exe
File created	C:\Windows\Cursors\Aero\SETB716.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_link.cur	rundll32.exe
File created	C:\Windows\Cursors\Aero\SETB718.tmp	rundll32.exe
File created	C:\Windows\Cursors\Aero\SETB6F2.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_ew.cur	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB705.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_nesw.cur	rundll32.exe
File created	C:\Windows\Cursors\Aero\SETB6DC.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB6ED.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_select.cur	rundll32.exe
File created	C:\Windows\Cursors\Aero\SETB6F1.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_prec.cur	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB718.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_alt.cur	rundll32.exe
File created	C:\Windows\Cursors\Aero\SETB6ED.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_busy.ani	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB6F1.tmp	rundll32.exe
File created	C:\Windows\Cursors\Aero\SETB715.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_ns.cur	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_nwse.cur	rundll32.exe
File created	C:\Windows\Cursors\Aero\SETB717.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB719.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_helpsel.cur	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB6EE.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB6EF.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_unavail.cur	rundll32.exe
File created	C:\Windows\Cursors\Aero\SETB719.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB715.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB716.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB6DC.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_working.ani	rundll32.exe
File created	C:\Windows\Cursors\Aero\SETB6F0.tmp	rundll32.exe
File created	C:\Windows\Cursors\Aero\SETB6F4.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_arrow.cur	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\aero_pen.cur	rundll32.exe
File opened for modification	C:\Windows\svchost.com	svchost.com
File created	C:\Windows\Cursors\Aero\SETB6EE.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB6F4.tmp	rundll32.exe
File created	C:\Windows\Cursors\Aero\SETB705.tmp	rundll32.exe
File opened for modification	C:\Windows\Cursors\Aero\SETB717.tmp	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe

Modifies Control Panel 20 IoCs

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\Arrow = "%SYSTEMROOT%\\Cursors\\Aero\\aero_arrow.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\SizeWE = "%SYSTEMROOT%\\Cursors\\Aero\\aero_ew.cur"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\Schemes	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\Schemes\Aero = "C:\\Windows\\Cursors\\Aero\\aero_arrow.cur,C:\\Windows\\Cursors\\Aero\\aero_helpsel.cur,C:\\Windows\\Cursors\\Aero\\aero_working.ani,C:\\Windows\\Cursors\\Aero\\aero_busy.ani,C:\\Windows\\Cursors\\Aero\\aero_prec.cur,C:\\Windows\\Cursors\\Aero\\aero_select.cur,C:\\Windows\\Cursors\\Aero\\aero_pen.cur,C:\\Windows\\Cursors\\Aero\\aero_unavail.cur,C:\\Windows\\Cursors\\Aero\\aero_ns.cur,C:\\Windows\\Cursors\\Aero\\aero_ew.cur,C:\\Windows\\Cursors\\Aero\\aero_nwse.cur,C:\\Windows\\Cursors\\Aero\\aero_nesw.cur,C:\\Windows\\Cursors\\Aero\\aero_move.cur,C:\\Windows\\Cursors\\Aero\\aero_alt.cur,C:\\Windows\\Cursors\\Aero\\aero_link.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\ = "Aero"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\Scheme Source = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\Hand = "%SYSTEMROOT%\\Cursors\\Aero\\aero_link.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\IBeam = "%SYSTEMROOT%\\Cursors\\Aero\\aero_select.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\No = "%SYSTEMROOT%\\Cursors\\Aero\\aero_unavail.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\SizeNWSE = "%SYSTEMROOT%\\Cursors\\Aero\\aero_nwse.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\Help = "%SYSTEMROOT%\\Cursors\\Aero\\aero_helpsel.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\AppStarting = "%SYSTEMROOT%\\Cursors\\Aero\\aero_working.ani"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\NWPen = "%SYSTEMROOT%\\Cursors\\Aero\\aero_pen.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\SizeNS = "%SYSTEMROOT%\\Cursors\\Aero\\aero_ns.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\UpArrow = "%SYSTEMROOT%\\Cursors\\Aero\\aero_alt.cur"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\Wait = "%SYSTEMROOT%\\Cursors\\Aero\\aero_busy.ani"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\Crosshair = "%SYSTEMROOT%\\Cursors\\Aero\\aero_prec.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\SizeNESW = "%SYSTEMROOT%\\Cursors\\Aero\\aero_nesw.cur"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\Cursors\SizeAll = "%SYSTEMROOT%\\Cursors\\Aero\\aero_move.cur"	rundll32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 4680	4476	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe	82
PID 4476 wrote to memory of 4680	4476	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe	82
PID 4476 wrote to memory of 4680	4476	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe	82
PID 4680 wrote to memory of 2856	4680	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe	83
PID 4680 wrote to memory of 2856	4680	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe	83
PID 4680 wrote to memory of 2856	4680	JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe	83
PID 2856 wrote to memory of 848	2856	svchost.com	84
PID 2856 wrote to memory of 848	2856	svchost.com	84
PID 2856 wrote to memory of 848	2856	svchost.com	84

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Windows\System32\rundll32.exe" advpack.dll,LaunchINFSection Mycursor.inf, DefaultInstall,3
    3⤵
    - Executes dropped EXE
    - System Binary Proxy Execution: Rundll32
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2856
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\System32\rundll32.exe advpack.dll,LaunchINFSection Mycursor.inf, DefaultInstall,3
      4⤵
      System Binary Proxy Execution: Rundll32
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Modifies Control Panel
      PID:848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE

Filesize
368KB

MD5
a344438de9e499ca3d9038688440f406

SHA1
c961917349de7e9d269f6f4a5593b6b9d3fcd4d2

SHA256
715f6420c423ae4068b25a703d5575f7c147b26e388f0fff1ae20c6abe821557

SHA512
8bf3c621725fddafa6326b057fee9beee95966e43c5fbab40ebaa4a1a64d17acca97a19d0ece10c3574e13e194ff191316871d1d46d4d74ffc0ac3efb403bca9

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe

Filesize
9.4MB

MD5
58f9bc16408d4db56519691315bb8a75

SHA1
ac94543044371e3ea49918eb0f114a29ab303004

SHA256
5562973f2b3aa9d0c6184143360f7861b4129605f5e63b896ad815f381e6475b

SHA512
e1884456f86bb7cf7d268942f6fc1bacaa550eac31aaf186d9e95c15bdc41d05638cfdea1762c92681225af72008d251b101e8f291e3a74f382832336b82d39d

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe

Filesize
131KB

MD5
5791075058b526842f4601c46abd59f5

SHA1
b2748f7542e2eebcd0353c3720d92bbffad8678f

SHA256
5c3ef3ec7594c040146e908014791dd15201ba58b4d70032770bb661b6a0e394

SHA512
83e303971ed64019fde9e4ba6f6e889f8fb105088490dfa7dcf579a12baff20ef491f563d132d60c7b24a4fd3cac29bd9dc974571cd162000fae8fba4e0e54fb

Download Submit
C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE

Filesize
254KB

MD5
4ddc609ae13a777493f3eeda70a81d40

SHA1
8957c390f9b2c136d37190e32bccae3ae671c80a

SHA256
16d65f2463658a72dba205dcaa18bc3d0bab4453e726233d68bc176e69db0950

SHA512
9d7f90d1529cab20078c2690bf7bffab5a451a41d8993781effe807e619da0e7292f991da2f0c5c131b111d028b3e6084e5648c90816e74dfb664e7f78181bc5

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe

Filesize
1.2MB

MD5
8e42f3a4a399d84e67ed633ba23863cb

SHA1
02ebfa5274214dcc48acfd24b8da3fb5cb93f6c6

SHA256
42716ea8beca9e555cef3b78a2fbf836c9da034318d625262810290309d955db

SHA512
0f6af721a89c2cf7249ecb1cc0a263c6252f8762b7381b35ccff6347d7d069799d2f0561bec0a651d690fbf29c98050bf15b604d3cca668b7437503ba102492f

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE

Filesize
121KB

MD5
cbd96ba6abe7564cb5980502eec0b5f6

SHA1
74e1fe1429cec3e91f55364e5cb8385a64bb0006

SHA256
405b8bd647fa703e233b8b609a18999abe465a8458168f1daf23197bd2ea36aa

SHA512
a551001853f6b93dfbc6cf6a681820af31330a19d5411076ff3dbce90937b3d92173085a15f29ebf56f2ef12a4e86860ac6723ebc89c98ea31ea7a6c7e3d7cdc

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe

Filesize
325KB

MD5
9a8d683f9f884ddd9160a5912ca06995

SHA1
98dc8682a0c44727ee039298665f5d95b057c854

SHA256
5e2e22ead49ce9cc11141dbeebbe5b93a530c966695d8efc2083f00e6be53423

SHA512
6aecf8c5cb5796d6879f8643e20c653f58bad70820896b0019c39623604d5b3c8a4420562ab051c6685edce60aa068d9c2dbb4413a7b16c6d01a9ac10dc22c12

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe

Filesize
325KB

MD5
892cf4fc5398e07bf652c50ef2aa3b88

SHA1
c399e55756b23938057a0ecae597bd9dbe481866

SHA256
e2262c798729169f697e6c30e5211cde604fd8b14769311ff4ea81abba8c2781

SHA512
f16a9e4b1150098c5936ec6107c36d47246dafd5a43e9f4ad9a31ecab69cc789c768691fa23a1440fae7f6e93e8e62566b5c86f7ed6bb4cfe26368149ea8c167

Download Submit
C:\PROGRA~2\Google\Update\1336~1.371\GOF5E2~1.EXE

Filesize
146KB

MD5
d9a290f7aec8aff3591c189b3cf8610a

SHA1
7558d29fb32018897c25e0ac1c86084116f1956c

SHA256
41bed95cb1101181a97460e2395efebb0594849e6f48b80a2b7c376ddf5ce0ea

SHA512
b55ab687a75c11ba99c64be42ad8471576aa2df10ce1bb61e902e98827e3a38cd922e365751bd485cac089c2bd8bccf939a578da7238506b77fe02a3eb7994c6

Download Submit
C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~1.EXE

Filesize
198KB

MD5
7429ce42ac211cd3aa986faad186cedd

SHA1
b61a57f0f99cfd702be0fbafcb77e9f911223fac

SHA256
d608c05409ac4bd05d8e0702fcf66dfae5f4f38cbae13406842fa5504f4d616f

SHA512
ee4456877d6d881d9904013aabecb9f2daf6fc0ec7a7c9251e77396b66a7f5a577fe8544e64e2bb7464db429db56a3fe47c183a81d40cc869d01be573ab5e4c1

Download Submit
C:\PROGRA~2\Google\Update\1336~1.371\GOOGLE~4.EXE

Filesize
433KB

MD5
674eddc440664b8b854bc397e67ee338

SHA1
af9d74243ee3ea5f88638172f592ed89bbbd7e0d

SHA256
20bbf92426732ff7269b4f2f89d404d5fee0fa6a20944004d2eeb3cc2d1fa457

SHA512
5aced0e2235f113e323d6b28be74da5e4da4dc881629461df4644a52bccd717dc6d2632c40ed8190b3ad060b8b62c347757a0bbe82680d892114c1f0529146b7

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MIA062~1.EXE

Filesize
1.7MB

MD5
4754ef85cf5992c484e75c0859cd0c12

SHA1
199b550e52f74d5a9932b1210979bc79a9b8f6fd

SHA256
da6de758d909ff5b7fb150a4a6a6b9774951aa2bd7c93966ea8951647386c330

SHA512
22c557807b81aac91c65643abb73f212d13f7c4504b6bb14e82bd9cf91319f2daadafa67425d91fa95f1d39c3700684f928e7d68468cb192c4c0be71b9f9b5ab

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE

Filesize
250KB

MD5
5d656c152b22ddd4f875306ca928243a

SHA1
177ff847aa898afa1b786077ae87b5ae0c7687c7

SHA256
4d87b0eb331443b473c90650d31b893d00373ff88dcbcb3747f494407799af69

SHA512
d5e50ee909ea06e69fc0d9999c6d142f9154e6f63462312b4e950cf6e26a7d395dbb50c8e2a8c4f4e1cfb7b2c6ae8ad19e3b7c204c20e7557daa1a0deb454160

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~3.EXE

Filesize
139KB

MD5
e6aecae25bdec91e9bf8c8b729a45918

SHA1
3097cddcb7d2a7512b8df9f5637d9bb52f6175ed

SHA256
a60e32baf0c481d6b9db3b84c205716fe2e588cb5089c3d0e4e942e453bf086d

SHA512
c9a6add86a2907f21c5049613fd8300800e4a949a943feea9ab36a271596343328bf0856e3d8dc4784b1c8357e01c3702761b8d9a3170ebd279dc4e1f1cacb01

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE

Filesize
244KB

MD5
da18586b25e72ff40c0f24da690a2edc

SHA1
27a388f3cdcfa7357f971b5c4411ea5aa1b9e5f5

SHA256
67f6e8f14bcf0e6d570c1f4ac5a1bb80a4e1470b5bad5a7ee85689c476597d8e

SHA512
3512820a9d37b61f77a79b2d4d3f6aec9ef53dbf81071bee16f5dcc8173393a1cd1bffe9f7f39467b72f9c9271a78e42078e68598934188d9df0b887f2edc5ab

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE

Filesize
276KB

MD5
4f197c71bb5b8880da17b80a5b59dd04

SHA1
c3d4b54f218768e268c9114aa9cdaf36a48803cd

SHA256
a1a0bf09839e6175e5508271774c6d94f4eb2130c914ea7666c1ecaf1a6fde47

SHA512
e6104ade74dc18e05be756e2a287b9940cdc98150ddd7c562b61282d57070e1d7272316469f1e1b294d3dfbcf191c2692de0d45a2fae59e73c4c039d80f3e002

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~1.EXE

Filesize
1.1MB

MD5
a5d9eaa7d52bffc494a5f58203c6c1b5

SHA1
97928ba7b61b46a1a77a38445679d040ffca7cc8

SHA256
34b8662d38e7d3d6394fa6c965d943d2c82ea06ba9d7a0af4f8e0571fb5a9c48

SHA512
b6fdc8389bb4d736d608600469be6a4b0452aa3ea082f9a0791022a14c02b8fb7dcd62df133b0518e91283094eaba2be9318316f72d2c4aae6286d3e8686e787

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe

Filesize
3.2MB

MD5
9ccbe770dfaf7fc66e535bcfb1e25f43

SHA1
9a57d13a14c8feebaa72592b05f56c41acba7cc5

SHA256
e1f7231e4f4bc2260a93cd1b69237786a8b6764f4637397fdb676681e66bcda9

SHA512
80a2e09bb8dcf7f9cad749cf71acebb93f6efd3913e3cedfccef7b9a59008dd55d55a237dcb7bfbab86f47ef6f3e0165e0a7987b378f536e68ec91a613f24e7b

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE

Filesize
1.1MB

MD5
5c78384d8eb1f6cb8cb23d515cfe7c98

SHA1
b732ab6c3fbf2ded8a4d6c8962554d119f59082e

SHA256
9abd7f0aa942ee6b263cdc4b32a4110ddb95e43ad411190f0ea48c0064884564

SHA512
99324af5f8fb70a9d01f97d845a4c6999053d6567ba5b80830a843a1634b02eaf3c0c04ced924cf1b1be9b4d1dbbcb95538385f7f85ad84d3eaaa6dcdebcc8a6

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe

Filesize
3.2MB

MD5
5119e350591269f44f732b470024bb7c

SHA1
4ccd48e4c6ba6e162d1520760ee3063e93e2c014

SHA256
2b3aa9642b291932ba7f9f3d85221402a9d27078f56ef0e9c6bca633616e3873

SHA512
599b4ec673169d42a348d1117737b4ad4d7539574153df5a5c7689130c9ac5ff5cd00f3c8ec39adf32ff2b56be074081efcabb6456272c649703c3ea6cdaded4

Download Submit
C:\PROGRA~2\MOZILL~1\UNINST~1.EXE

Filesize
141KB

MD5
3cfd732cd6a3399c411739a8b75b5ae2

SHA1
242b02177cbec61819c11c35c903a2994e83ae10

SHA256
e90c627265bc799db00828179a5d76717a577086755043ba223a9ac78510a2ff

SHA512
b7b61c5f9dab2c6a4e5157a934db5bb26727418698fa44f05fbb9af38cd93dee0261f3f28700bc5cb21e8947a542c3ee6166375ea262c19d41e84c68b0d0fc72

Download Submit
C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe

Filesize
534KB

MD5
8a403bc371b84920c641afa3cf9fef2f

SHA1
d6c9d38f3e571b54132dd7ee31a169c683abfd63

SHA256
614a701b90739e7dbf66b14fbdb6854394290030cc87bbcb3f47e1c45d1f06c3

SHA512
b376ef1f49b793a8cd8b7af587f538cf87cb2fffa70fc144e1d1b7e2e8e365ba4ad0568321a0b1c04e69b4b8b694d77e812597a66be1c59eda626cbf132e2c72

Download Submit
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE

Filesize
6.7MB

MD5
63dc05e27a0b43bf25f151751b481b8c

SHA1
b20321483dac62bce0aa0cef1d193d247747e189

SHA256
7d607fb69c69a72a5bf4305599279f46318312ce1082b6a34ac9100b8c7762ce

SHA512
374d705704d456cc5f9f79b7f465f6ec7c775dc43001c840e9d6efbbdef20926ed1fa97f8a9b1e73161e17f72520b96c05fa58ac86b3945208b405f9166e7ba3

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE

Filesize
485KB

MD5
86749cd13537a694795be5d87ef7106d

SHA1
538030845680a8be8219618daee29e368dc1e06c

SHA256
8c35dcc975a5c7c687686a3970306452476d17a89787bc5bd3bf21b9de0d36a5

SHA512
7b6ae20515fb6b13701df422cbb0844d26c8a98087b2758427781f0bf11eb9ec5da029096e42960bf99ddd3d4f817db6e29ac172039110df6ea92547d331db4c

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

Filesize
714KB

MD5
24179b4581907abfef8a55ab41c97999

SHA1
e4de417476f43da4405f4340ebf6044f6b094337

SHA256
a8b960bcbf3045bedd2f6b59c521837ac4aee9c566001c01d8fc43b15b1dfdc7

SHA512
6fb0621ea3755db8af58d86bdc4f5324ba0832790e83375d07c378b6f569a109e14a78ed7d1a5e105b7a005194a31bd7771f3008b2026a0938d695e62f6ea6b8

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE

Filesize
674KB

MD5
9c10a5ec52c145d340df7eafdb69c478

SHA1
57f3d99e41d123ad5f185fc21454367a7285db42

SHA256
ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36

SHA512
2704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE

Filesize
536KB

MD5
7a36ae2055dc8aa5791f86a0583197b4

SHA1
deade87912580a5386096768f569781a92dbb9d4

SHA256
64d1449187d26e3b769300335ed0fc5d31e2a2ee2264774ea9da2c396a6d8328

SHA512
e042b3338617366afa3bbcd0f589f632a63567149b78172acb16524b6c488c10649578416f992146b70506fc55f3a9a79624bb87aac21fa80658afc5b5693680

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{63880~1\WINDOW~1.EXE

Filesize
650KB

MD5
558fdb0b9f097118b0c928bb6062370a

SHA1
ad971a9a4cac3112a494a167e1b7736dcd6718b3

SHA256
90cee4a89cc1401ac464818226b7df69aa930804cefce56758d4e2ea0009d924

SHA512
5d08d5428e82fb3dad55c19e2c029de8f16e121faac87575b97f468b0ec312b3e0696225546cba91addaaf8f2451d44ae6386b4e4f7f621ce45055f3be797d7c

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE

Filesize
485KB

MD5
87f15006aea3b4433e226882a56f188d

SHA1
e3ad6beb8229af62b0824151dbf546c0506d4f65

SHA256
8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919

SHA512
b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{D87AE~1\WINDOW~1.EXE

Filesize
650KB

MD5
2f826daacb184077b67aad3fe30e3413

SHA1
981d415fe70414aaac3a11024e65ae2e949aced8

SHA256
a6180f0aa9c56c32e71fe8dc150131177e4036a5a2111d0f3ec3c341fd813222

SHA512
2a6d9bdf4b7be9b766008e522cbb2c21921ba55d84dfde653ca977f70639e342a9d5548768de29ae2a85031c11dac2ae4b3c76b9136c020a6e7c9a9a5879caeb

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF5AF~1\WINDOW~1.EXE

Filesize
650KB

MD5
72d0addae57f28c993b319bfafa190ac

SHA1
8082ad7a004a399f0edbf447425f6a0f6c772ff3

SHA256
671be498af4e13872784eeae4bae2e462dfac62d51d7057b2b3bebff511b7d18

SHA512
98bcde1133edbff713aa43b944dceb5dae20a9cbdf8009f5b758da20ccfbcdf6d617f609a7094aa52a514373f6695b0fd43c3d601538483816cd08832edd15ab

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

Filesize
536KB

MD5
91490c78c45cbd686ac759b6a252e898

SHA1
51bb6c5aa14cf478b0b6fa0329c7366d1f6fb480

SHA256
47f3331b4f35012d38bc11cdeae0ff7b4ae1186d4e916e3e48a9440438296821

SHA512
f7d44cd6df2c0c492731c14ca27e26605e8cddb9cb9287bf083fe1e43f753cafa11c341f0915510ad1d189466e92bb3f4e219b3599e9df72878bde14518bee35

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_46e61d1b5376dd6642a40e5465318410.exe

Filesize
153KB

MD5
3156fa664111c639c4a93b573618c240

SHA1
c68c519551aa903709154b729c4dff86f2f498c8

SHA256
1277746f4a302f644ac2910b7e80b51a9cf7c55be8f88fc8cdfae7b01dbf58be

SHA512
2e733c073f0641f3b12f914c384535769b1ec45aa478537edf9177585354fabe08314193df00327bd57ca0a994d425ece9cfe534716c7c61fb86ffb534200cb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_A~1.CUR

Filesize
4KB

MD5
ea1996c015e146d484888cbb90581691

SHA1
83d349bb3c870b7f048f7c132de62bc4094b940a

SHA256
bd5863c01bdad1b10b08726e1932dac53aedfa0737be305c63df536afd9b3b74

SHA512
7695ccea64201928ef36237fa6d3c0c564aa380b6323fda9178931e9ea2e4cd61f999c59972f0ca1b14b5b7eee4631dbcaa09d52898ba5aebba4aa7de521a9ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_H~1.CUR

Filesize
4KB

MD5
0008689d017e143ff49f38b94d63876d

SHA1
3889edd8815d5bbf26f6f12358fc15284b65d49d

SHA256
559eeaad1f057226d2965c507094a72584a3f23d2a987635cf0f53b7ea79b33b

SHA512
d1aae27536bdad5e522aa3e2a9f58cbe21f868ab44db0e44f5129e72c40a263587da998600927b8666bd8d8dc1dc8ac0e8235f47131c4f46b4d9e2318237e863

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_L~1.CUR

Filesize
4KB

MD5
ad452e2520bacd56a35f125616480c3c

SHA1
33a9daa7c6766c95848b94e1010e50d5e4e3ec7c

SHA256
98fdf59ac899a9c2510b5064b50be5b61b48ccfd0b9247874a6097793f2c3057

SHA512
29d95def709e6c290ace4a8deba553345af0d78b618b9659bf0bc37495053582c060409a450b1f5c0fdde74fece01629a4c2a5c401b293e2cc04634d1e858f42

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_M~1.CUR

Filesize
4KB

MD5
e5dcb831e11ec5d8a0f2e51656bccba0

SHA1
9d80e249984c5a835c361c86a8057132efe3b177

SHA256
54181c6b555396ba623781663dc20388edf85cfc49a7d86466dbb937dcead4b3

SHA512
9ef4dbb16947b740dc747a57c4f5a109dde242f15e33533a73e295d6e6ec2a8a9307b59e9d3ff2716e4a77039df34596b3c335d93255374e7155e1c1875d975b

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_N~2.CUR

Filesize
4KB

MD5
d3f4e3b187ded3f53cdc7435a10d23b2

SHA1
76e95f1eefd8e7af946c9a6149a0b16824a6adb8

SHA256
26ba676103297f4fe9dba4d49238be80b1a7dbb1e869ec1a0986c6e7afdfd07b

SHA512
4ce0b8a8a01db56ecdbaaccb60f34ffd54496dfaca02c115fe358fd923b54e256196c7d2286d7644670ec0e4de9b796c2c3d659078868ce4ce6ce6a129227a04

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_P~1.CUR

Filesize
4KB

MD5
e67d9223b642c25aabc6bc3e1b9067cc

SHA1
7655e8328a20428f92cda20c3361e196614b9c7b

SHA256
82960bbb060bf78779c736e325c83a30fb44f8f5d4d05ba984f7594e2f7438b5

SHA512
8d9d821b910fa253368c7c7ed4e59034c06eb728320424686b0bbf9a6815639a6d46627d7a6fecb2599a6d67104e853d47fa0660ab05ad74fec207013c7d79b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\AERO_W~1.ANI

Filesize
75KB

MD5
02c86ee6b68148cdbdf9cce3b50c5938

SHA1
725944fa8060c054508319d55b4e3e11149f72d1

SHA256
8685bf675bed7c0626fed013acf52ab81b9a3ba09e6830a5733d43a50d43a73c

SHA512
bb9cf3d6d150059d72c0d77d3d1bc0a22ad65e720e9276e6ac6d4bae94e00fb834158f7b670195eb15806770d777db4265fcb18a7ef15a291907479a18843083

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Mycursor.inf

Filesize
2KB

MD5
f74176552e3d4a527b7b9dde52fa00d6

SHA1
f83e181b886d943d092bbae22baaaeb98c6f40bf

SHA256
d9de7ae638b0347d48055dbf60142fe65978cc5cb2b8d7f54a61916c1cc103d4

SHA512
2d79064cb20af742fc36963c001ec24fa7db36819c5d2a9ce463ded8475ead6e9251dfbf9dbad5eaf62a5bace1d210e30dc175ea143c2ca6f579d1afa7e74e3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\aero_alt.cur

Filesize
4KB

MD5
edd96aef0347b025a8544d3fac0ce120

SHA1
3709730eb773672e9f8baa072760708eeb83779c

SHA256
e12b2bb99ec88e854843af4ad59aa2b7848fac401102a692896d5cb9ee7b3969

SHA512
0ce753bdd93ce44b8b6edc3f1e00209a5f218ae24c1f47b841a7fce3f88936557913d0948706527197c19831908e336896c9428be19ec7cb8f6d653a7990d277

Download Submit
C:\Windows\Cursors\Aero\aero_busy.ani

Filesize
75KB

MD5
27eb04af547dab9b3648605327e847bd

SHA1
733444f7d23dfd26089a9662e11077e56e4fbc66

SHA256
a8ab3345ac31bb07edfc972933e244edd73b9416e4cb9bbe975472e3a50b12a9

SHA512
730dff6e1a097542502719a2c73ce65e98e869fc24fee4cbf658373411528926b5579c16931815a15b038c9f9d47b499e95f02f0545e6fc3a0efb2cb3de120e8

Download Submit
C:\Windows\Cursors\Aero\aero_ew.cur

Filesize
4KB

MD5
d680063d9d9cae42bb1e00701533539b

SHA1
1d9c43332989a4c872d7012f1601ac594160d9da

SHA256
093c36f1baa94b49498b173a197a99c72835381aa0b1823ae669eb19adfcc430

SHA512
7a9711662261a6085434799c155aca145822e35586a1f8118b3c5828c2d49549e02855a09ae555d18c2ee83310d5fedeead90ba7d5e4fe60625ccb3878bfb841

Download Submit
C:\Windows\Cursors\Aero\aero_nesw.cur

Filesize
4KB

MD5
6f2eb112fe01ee3c84bbbfa64092b079

SHA1
e0ecdcc506e6b3ee6c25e3fa78ad8a7cd6a15476

SHA256
de8ca70a6bd0e8738200cfe5a9d2e50514c8274e39e9939493726cc307ea7df4

SHA512
b5c9eebecb25dfc2a8069e346381f3c401a4a9a6a568627a80fe131a87a6223d851e57578aa87c413943a22dab6dd88c43e617c02ca3130d90a194b87c6aa272

Download Submit
C:\Windows\Cursors\Aero\aero_ns.cur

Filesize
4KB

MD5
f55ee079e1584126368a0a003cf5da52

SHA1
7f9545c3da864c57ac5dd6aa2ece330249f8529b

SHA256
ae87e1be2012a8d22db328bec839cc01705776df4a8668a373d2d7efd918cc09

SHA512
776e5fb73980edf7413079bd63de42d92880a4d61e06cddcbde87f0a54b19eeb66d27825953dbcca75d3112e8830cfe3db96f06a0bff2392cd8d2e68ba0a5bb5

Download Submit
C:\Windows\Cursors\Aero\aero_pen.cur

Filesize
4KB

MD5
8908dc992d2868e7cac099e5866169fa

SHA1
0677d5f99f329f657dba1e511937df8e977cb51e

SHA256
7e99a350ddaf9d1bf939f26a0a365e6677b0770ef70332fc478729473598c46a

SHA512
e2c3f3e2fdf18caf609c2b560475a55c3a1aefbd5462b56278179baf0176ab11b2af292ae61c6ac4134114884b5817eb702c4ab32d8aa608d30ab429d20e982c

Download Submit
C:\Windows\Cursors\Aero\aero_select.cur

Filesize
4KB

MD5
fb4034a0dff9163fde813a30b2c1d1c1

SHA1
735bc76fbd197699243a4033b419714c2b76de38

SHA256
df2de2269ac181eca37be88f50613d4e64fe1bb32e597b442f681e470db33b14

SHA512
98b1e91d9fbf8e0ee5471ed93154e13b08b0f83e1a8858f717ed52d1111887ac3a610d25f412ea3844305db47d0434454cda0b7115b9f9c36e9c1dab3788e11b

Download Submit
C:\Windows\Cursors\Aero\aero_unavail.cur

Filesize
4KB

MD5
ec5e4f9c4749a4aae668fa7ccafecff4

SHA1
2cb204d7594ecf738949f48949aa6f7e2b54750a

SHA256
d765ab5b0ee32b0a8cb3b3b133766101bf95741afb6a45621acae0b8ca662bfc

SHA512
f8126967bf44bbd77a795ae44aaf6c84142407ee9f5c499a31bf6e15e5112e22ed0866f5d7a555274ab77550ff2006b423c1b2c12da3a9d6927e99e147d62aa1

Download Submit
C:\Windows\svchost.com

Filesize
40KB

MD5
6b26844eaa7c78f46ac6f3490275a2b8

SHA1
4e248e4097cdf49d5ca6b7a4a1b28512bef78c44

SHA256
ff4f1b62afdb5f2ff2ca6b473367772d5adbe16986bc5e5b20fea836e9cbd1f5

SHA512
7e1ac515a11d359fa86f433de5090678ba1b53da3df0f771f4f29d225a5b181dbdbd21b657873f52f8b7d4b3071cbd7971b4acc8515b0201eecaa72b59efc553

Download Submit
memory/2856-244-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2856-247-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2856-250-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2856-252-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4476-242-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4476-245-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4476-248-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4476-253-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4680-243-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download
memory/4680-255-0x0000000000400000-0x0000000000424000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads