neshta | 8a04f5a058b6ddd9f97193981f70de94245fb83c93f44454a8e5216fcfb19bd8

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-01-2025 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
Size

103KB
MD5

62f004115b1d3e0d06c2725aa26d7120
SHA1

49e8311509be07ad6a0ae3f3a35503beaf5fd614
SHA256

8a04f5a058b6ddd9f97193981f70de94245fb83c93f44454a8e5216fcfb19bd8
SHA512

ad300dbe2b53acf16135ec04b70f4241b735e51f62c4611769285cf7866293ea68ad0fd5f8c50ab0955ec6d088e2146cdecfa3bb7ce8076b973cb076e742bf18
SSDEEP

1536:JxqjQ+P04wsmJCN1anMHEM+K+JQ9D+yaFzSgY/v6MF72/RCe:sr85CLHOK4+Cgw5Ce

Score

10^/10

neshta discovery persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 27 IoCs

resource	yara_rule
behavioral1/files/0x0001000000010318-11.dat	family_neshta
behavioral1/files/0x0008000000016d0c-12.dat	family_neshta
behavioral1/files/0x005b00000001032b-22.dat	family_neshta
behavioral1/files/0x0001000000010316-24.dat	family_neshta
behavioral1/files/0x001400000000f842-23.dat	family_neshta
behavioral1/memory/2244-37-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/files/0x000100000000f7dd-39.dat	family_neshta
behavioral1/files/0x000100000000f77b-43.dat	family_neshta
behavioral1/files/0x000100000000f7eb-49.dat	family_neshta
behavioral1/files/0x000100000000f7cf-48.dat	family_neshta
behavioral1/files/0x0001000000011800-63.dat	family_neshta
behavioral1/files/0x0001000000010f34-66.dat	family_neshta
behavioral1/files/0x0003000000012143-84.dat	family_neshta
behavioral1/files/0x00030000000120dc-145.dat	family_neshta
behavioral1/files/0x00030000000120e0-146.dat	family_neshta
behavioral1/files/0x000300000000e705-152.dat	family_neshta
behavioral1/files/0x000d0000000056db-155.dat	family_neshta
behavioral1/files/0x0003000000005abd-161.dat	family_neshta
behavioral1/files/0x000b000000005990-163.dat	family_neshta
behavioral1/files/0x000400000000572d-162.dat	family_neshta
behavioral1/files/0x00050000000055e5-160.dat	family_neshta
behavioral1/memory/1204-164-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1568-165-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2708-166-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2708-171-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1204-173-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/1568-172-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Executes dropped EXE 4 IoCs

pid	Process
1468	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
1568	svchost.com
2244	svchost.com
2764	JAFFAC~1.EXE

Loads dropped DLL 5 IoCs

pid	Process
1204	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
2244	svchost.com
2708	JAFFAC~1.EXE
1204	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
1204	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	JAFFAC~1.EXE
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	JAFFAC~1.EXE

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\directx.sys	JAFFAC~1.EXE
File opened for modification	C:\Windows\svchost.com	JAFFAC~1.EXE
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com
File opened for modification	C:\Windows\svchost.com	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
File opened for modification	C:\Windows\directx.sys	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JAFFAC~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JAFFAC~1.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 1468	1204	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe	30
PID 1204 wrote to memory of 1468	1204	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe	30
PID 1204 wrote to memory of 1468	1204	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe	30
PID 1204 wrote to memory of 1468	1204	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe	30
PID 1468 wrote to memory of 1568	1468	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe	31
PID 1468 wrote to memory of 1568	1468	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe	31
PID 1468 wrote to memory of 1568	1468	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe	31
PID 1468 wrote to memory of 1568	1468	JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe	31
PID 1568 wrote to memory of 2708	1568	svchost.com	32
PID 1568 wrote to memory of 2708	1568	svchost.com	32
PID 1568 wrote to memory of 2708	1568	svchost.com	32
PID 1568 wrote to memory of 2708	1568	svchost.com	32
PID 2708 wrote to memory of 2244	2708	JAFFAC~1.EXE	33
PID 2708 wrote to memory of 2244	2708	JAFFAC~1.EXE	33
PID 2708 wrote to memory of 2244	2708	JAFFAC~1.EXE	33
PID 2708 wrote to memory of 2244	2708	JAFFAC~1.EXE	33
PID 2244 wrote to memory of 2764	2244	svchost.com	34
PID 2244 wrote to memory of 2764	2244	svchost.com	34
PID 2244 wrote to memory of 2764	2244	svchost.com	34
PID 2244 wrote to memory of 2764	2244	svchost.com	34

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1468
- - C:\Windows\svchost.com
    "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE" end
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE
      C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE end
      4⤵
      Loads dropped DLL
      Drops file in Program Files directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Windows\svchost.com
        
        "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE" end
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE
        
        C:\Users\Admin\AppData\Local\Temp\3582-490\JAFFAC~1.EXE end
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE

Filesize
859KB

MD5
02ee6a3424782531461fb2f10713d3c1

SHA1
b581a2c365d93ebb629e8363fd9f69afc673123f

SHA256
ead58c483cb20bcd57464f8a4929079539d634f469b213054bf737d227c026dc

SHA512
6c9272cb1b6bde3ee887e1463ab30ea76568cb1a285d11393337b78c4ad1c3b7e6ce47646a92ab6d70bff4b02ab9d699b84af9437b720e52dcd35579fe2693ec

Download Submit
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
cf6c595d3e5e9667667af096762fd9c4

SHA1
9bb44da8d7f6457099cb56e4f7d1026963dce7ce

SHA256
593e60cc30ae0789448547195af77f550387f6648d45847ea244dd0dd7abf03d

SHA512
ff4f789df9e6a6d0fbe12b3250f951fcf11e857906c65e96a30bb46266e7e1180d6103a03db2f3764e0d1346b2de7afba8259ba080057e4a268e45e8654dfa80

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe

Filesize
186KB

MD5
58b58875a50a0d8b5e7be7d6ac685164

SHA1
1e0b89c1b2585c76e758e9141b846ed4477b0662

SHA256
2a0aa0763fdef9c38c5dd4d50703f0c7e27f4903c139804ec75e55f8388139ae

SHA512
d67214077162a105d01b11a8e207fab08b45b08fbfba0615a2ea146e1dd99eea35e4f02958a1754d3192292c00caf777f186f0a362e4b8b0da51fabbdb76375b

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe

Filesize
1.1MB

MD5
566ed4f62fdc96f175afedd811fa0370

SHA1
d4b47adc40e0d5a9391d3f6f2942d1889dd2a451

SHA256
e17cd94c08fc0e001a49f43a0801cea4625fb9aee211b6dfebebec446c21f460

SHA512
cdf8f508d396a1a0d2e0fc25f2ae46398b25039a0dafa0919737cc44e3e926ebae4c3aa26f1a3441511430f1a36241f8e61c515a5d9bd98ad4740d4d0f7b8db7

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE

Filesize
313KB

MD5
8c4f4eb73490ca2445d8577cf4bb3c81

SHA1
0f7d1914b7aeabdb1f1e4caedd344878f48be075

SHA256
85f7249bfac06b5ee9b20c7f520e3fdc905be7d64cfbefb7dcd82cd8d44686d5

SHA512
65453075c71016b06430246c1ee2876b7762a03112caf13cff4699b7b40487616c88a1160d31e86697083e2992e0dd88ebf1721679981077799187efaa0a1769

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE

Filesize
569KB

MD5
eef2f834c8d65585af63916d23b07c36

SHA1
8cb85449d2cdb21bd6def735e1833c8408b8a9c6

SHA256
3cd34a88e3ae7bd3681a7e3c55832af026834055020add33e6bd6f552fc0aabd

SHA512
2ee8766e56e5b1e71c86f7d1a1aa1882706d0bca8f84b2b2c54dd4c255e04f037a6eb265302449950e5f5937b0e57f17a6aa45e88a407ace4b3945e65043d9b7

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe

Filesize
381KB

MD5
3ec4922dbca2d07815cf28144193ded9

SHA1
75cda36469743fbc292da2684e76a26473f04a6d

SHA256
0587fd366ea7e94b3ae500874b1c5d684b5357fcc7389682d5a13c3301a28801

SHA512
956c3a1f2689cb72600edd2e90d652b77592a8a81d319dce026e88f6c02231af06aebd57d68460eb406de00c113522173423cb1b339a41a3918f379c7dc311f7

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe

Filesize
137KB

MD5
e1833678885f02b5e3cf1b3953456557

SHA1
c197e763500002bc76a8d503933f1f6082a8507a

SHA256
bd9a16d8d7590a2ec827913db5173f8beb1d1ef44dab1920ef52a307f922bc14

SHA512
fe107e1c8631ec6ac94f772e6a7be1fdc2a533fe3cfcf36b1ff018c8d01bd7f1f818f0a2448f736838c953cd516ea7327c416dea20706ed2420327af8ef01abe

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE

Filesize
270KB

MD5
3a928dbfdd154534651434bc1c574259

SHA1
8619df5eaaa8ceab6418136789d2f172ce0d2a83

SHA256
00ca35c94353f0c583bc4423a7623631673400a1c3c6678cf565fa202769f148

SHA512
ce942aca8a23de012b8adfda84a630c1e8fc2431ace86e953aa2a8966d7e89d7631b7aed8a0810387c1d4413a1ea1b519167c57287071b05e09c5dec1efae826

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE

Filesize
503KB

MD5
3f67da7e800cd5b4af2283a9d74d2808

SHA1
f9288d052b20a9f4527e5a0f87f4249f5e4440f7

SHA256
31c10320edb2de22f37faee36611558db83b78a9c3c71ea0ed13c8dce25bf711

SHA512
6a40f4629ddae102d8737e921328e95717274cea16eb5f23bff6a6627c6047d7f27e7f6eb5cb52f53152e326e53b6ee44d9a9ee8eca7534a2f62fa457ac3d4e3

Download Submit
C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE

Filesize
248KB

MD5
863087d206bd42785c4d49facc32da19

SHA1
d9546a1ebbb0a8359d75ce930c03086c7d5823f4

SHA256
cce0b71faa0b880f11bddf648d6025d5816c7078006fa8c1e663ab957af20ea4

SHA512
8f696f910e451ddff26f1e083fe8a889694305ea3cc226bdbb1c64cd0b6ee8b15b382a0eee77be159f347f1bbe55d12e8a0e2d63777ab62a74e17c15968465af

Download Submit
C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE

Filesize
267KB

MD5
15163eb05b0a8f65a5ca3c74a658077d

SHA1
8b116062a5754fa2d73fc4df9f635283ae1ccd02

SHA256
8751c43ee0f3f0e080103a9b77be9e79346004769ed43d4cadd630ea15d26dcf

SHA512
a8299e9a522aa58429847920b999598551c1863f63ba473178f61cde43fb91cab6ef62c9e1a51268e54338e012ccfe6428a7c37bc89007d1604fafa2560258c9

Download Submit
C:\PROGRA~2\MOZILL~1\UNINST~1.EXE

Filesize
181KB

MD5
03e8d88ea2c40acbd13a14bcd703d690

SHA1
7edfb1f75e90cd839ffd09b87f734cfd54c45aac

SHA256
3238959a01379682782d2e239f98f8026ec6c60d8da7fa7a6db50023f77c8c8b

SHA512
c4e948da522adecf409a74257b7f770289454de6dc17c116231527064e94cf6e34fb3fc8a10ab0fd3da4f57abef1be47659aab1c1a072d7ab4664bc4003575d0

Download Submit
C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE

Filesize
674KB

MD5
9c10a5ec52c145d340df7eafdb69c478

SHA1
57f3d99e41d123ad5f185fc21454367a7285db42

SHA256
ccf37e88447a7afdb0ba4351b8c5606dbb05b984fb133194d71bcc00d7be4e36

SHA512
2704cfd1a708bfca6db7c52467d3abf0b09313db0cdd1ea8e5d48504c8240c4bf24e677f17c5df9e3ac1f6a678e0328e73e951dc4481f35027cb03b2966dc38f

Download Submit
C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE

Filesize
485KB

MD5
87f15006aea3b4433e226882a56f188d

SHA1
e3ad6beb8229af62b0824151dbf546c0506d4f65

SHA256
8d0045c74270281c705009d49441167c8a51ac70b720f84ff941b39fad220919

SHA512
b01a8af6dc836044d2adc6828654fa7a187c3f7ffe2a4db4c73021be6d121f9c1c47b1643513c3f25c0e1b5123b8ce2dc78b2ca8ce638a09c2171f158762c7c1

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE

Filesize
526KB

MD5
cc5020b193486a88f373bedca78e24c8

SHA1
61744a1675ce10ddd196129b49331d517d7da884

SHA256
e87936bb1f0794b7622f8ce5b88e4b57b2358c4e0d0fd87c5cd9fa03b8429e2a

SHA512
bc2c77a25ad9f25ac19d8216dafc5417513cb57b9984237a5589a0bb684fdac4540695fcfb0df150556823b191014c96b002e4234a779bd064d36166afeb09d2

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

Filesize
674KB

MD5
97510a7d9bf0811a6ea89fad85a9f3f3

SHA1
2ac0c49b66a92789be65580a38ae9798237711db

SHA256
c48abbc29405559e68cc9f8fc6d218aa317a9d0023839c7846ca509c1f563fea

SHA512
2a93e2a3bd187fdde160f87ef777ccd1d1c398d547b7c869e6b64469b9418ad04d887cdfe94af7407476377bf2d009f576de3935c025b7aefbab26fbcd8f90fb

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE

Filesize
495KB

MD5
9597098cfbc45fae685d9480d135ed13

SHA1
84401f03a7942a7e4fcd26e4414b227edd9b0f09

SHA256
45966655baaed42df92cd6d8094b4172c0e7a0320528b59cf63fca7c25d66e9c

SHA512
16afbdffe4b4b2e54b4cc96fe74e49ca367dea50752321ddf334756519812ba8ce147ef5459e421dc42e103bc3456aab1d185588cc86b35fa2315ac86b2a0164

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

Filesize
495KB

MD5
07e194ce831b1846111eb6c8b176c86e

SHA1
b9c83ec3b0949cb661878fb1a8b43a073e15baf1

SHA256
d882f673ddf40a7ea6d89ce25e4ee55d94a5ef0b5403aa8d86656fd960d0e4ac

SHA512
55f9b6d3199aa60d836b6792ae55731236fb2a99c79ce8522e07e579c64eabb88fa413c02632deb87a361dd8490361aa1424beed2e01ba28be220f8c676a1bb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp

Filesize
8B

MD5
05b525d3396f085121906a90e8052987

SHA1
e3f6c32e9902ec524e4ce1bdff5e87d7acf56c9f

SHA256
2228e38b01513e85d4f63e9b31985a19ea9ef2c60e77d1f8654a20b591095d67

SHA512
025b543be85db3c9b337eaabc1b99c2dd48b4cec791328a3ed712926325d001128e999bc910f9012fae49428ac9b3057f2d914edddb1e97e0ff343faefa30d9a

Download Submit
C:\Windows\directx.sys

Filesize
57B

MD5
d00231277f818c7c8935a9a5d6a5b8e3

SHA1
d883f120b0a14328e11b9028cffe4cea3dd70dc0

SHA256
0d0094ea9f36f6093e06011b4bff3a72b6f71c0381d3d8308258dcd8a7f53672

SHA512
41eb2facce332aad49b3c8dd635d8428ccaebb489e7ca81cb8348eeb736b77ed3fdca2923e7e56a9b35d89a3fd4f0945be58376093afb9890e77572f2df7418a

Download Submit
C:\Windows\svchost.com

Filesize
40KB

MD5
c15ed0c6e63ccafa19a2aeca44356796

SHA1
ed00e3529849e411d50a26dd9e938b1771163e2a

SHA256
6b8250c285443d37ee53ab6693a788341e56b9561f4d9c2b546a3bf7cbc19724

SHA512
e02b117c6ade35a5a654cdf7a680a44361aa8c5cd75bd026fc767acc3450f9778eb2e1c63d7a986bdbdbe22e576d267f9ee61a4a9fb2e04d35142c477b186bf1

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_62f004115b1d3e0d06c2725aa26d7120.exe

Filesize
62KB

MD5
8f0bd6e9f75860f3e793f3d65a2327bf

SHA1
c03e4bc1262a44bc68918efd10798dc60f79274d

SHA256
64fdcaafc35c5cf5da0fb01218673d3806c1b6f9b77adec4e36e180497c94f43

SHA512
3d4d1c9d0a9c42b5619171061294bfc74ac6a3fc9669675dc119d7af9d3a1ab3b69b8e3166ba55449b8a82cf0088cd7bf438aa666ea7fbfd90396b57fd4bf88d

Download Submit
memory/1204-164-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1204-173-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1468-13-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1568-165-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1568-172-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2244-37-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2708-166-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2708-171-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2764-36-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads