Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
02/01/2025, 10:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
Resource
win7-20240903-en
windows7-x64
21 signatures
150 seconds
General
- Target JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe
- Size 618KB
- Sample250102-l494jsxjft
- SHA256 330558405a5486392d856908bf7592473c817685d266289b425e93a676661bee
- MD5 644e4d14dc2e71ecc9d70a2da540a360
- SHA1 16c218c345c43c62bc8521ca2ae6f6dafd0fc2dd
- SHA512 ba6434209666d03aaeb921b0434b4dd5c27e816a3bb92a86f89abb03fb9b6bc8b9c3f9d18752f6e36fc84d82fe9138b3e65fa22921b0eb6f3d99f179f8762e4a
- SSDEEP 12288:mbhv02bZop2mk2jALtaOWe6x9aGMjefpxlLpNjt6bVqyYSiOPAW:mb502b2pdkKARIe6qGIYxpjgVDYgF
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Expiro family
- Expiro payload 1 IoCs
resource yara_rule behavioral2/memory/1360-2-0x0000000001000000-0x000000000125A000-memory.dmp family_expiro1 - Disables taskbar notifications via registry modification
- Executes dropped EXE 5 IoCs
pid Process 3956 elevation_service.exe 2348 elevation_service.exe 3448 maintenanceservice.exe 1960 OSE.EXE 1980 ssh-agent.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3350944739-639801879-157714471-1000 elevation_service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3350944739-639801879-157714471-1000\EnableNotifications = "0" elevation_service.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mdgkfajodaliacghnafobjnclblcfmlm\1.0_0\manifest.json JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe - Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\Q: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\Q: elevation_service.exe File opened (read-only) \??\X: elevation_service.exe File opened (read-only) \??\E: elevation_service.exe File opened (read-only) \??\G: elevation_service.exe File opened (read-only) \??\Y: elevation_service.exe File opened (read-only) \??\J: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\K: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\V: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\I: elevation_service.exe File opened (read-only) \??\V: elevation_service.exe File opened (read-only) \??\M: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\S: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\J: elevation_service.exe File opened (read-only) \??\E: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\O: elevation_service.exe File opened (read-only) \??\W: elevation_service.exe File opened (read-only) \??\K: elevation_service.exe File opened (read-only) \??\L: elevation_service.exe File opened (read-only) \??\M: elevation_service.exe File opened (read-only) \??\G: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\H: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\U: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\X: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\H: elevation_service.exe File opened (read-only) \??\N: elevation_service.exe File opened (read-only) \??\P: elevation_service.exe File opened (read-only) \??\S: elevation_service.exe File opened (read-only) \??\W: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\R: elevation_service.exe File opened (read-only) \??\T: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\Y: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\Z: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\I: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\L: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\O: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\P: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\R: JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened (read-only) \??\T: elevation_service.exe File opened (read-only) \??\U: elevation_service.exe File opened (read-only) \??\Z: elevation_service.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification \??\c:\windows\system32\fxssvc.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\SysWOW64\snmptrap.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created \??\c:\windows\system32\ggaidiim.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\lsass.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\SysWOW64\searchindexer.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\openssh\ssh-agent.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created \??\c:\windows\system32\WindowsPowerShell\v1.0\onopglhd.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\dllhost.exe elevation_service.exe File opened for modification \??\c:\windows\system32\vds.exe elevation_service.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\locator.exe elevation_service.exe File opened for modification \??\c:\windows\SysWOW64\svchost.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\Appvclient.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created \??\c:\windows\system32\jqideopp.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\snmptrap.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\SysWOW64\vds.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\vds.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\svchost.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\spectrum.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\maiolibf.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\tieringengineservice.exe elevation_service.exe File opened for modification \??\c:\windows\SysWOW64\Appvclient.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\msdtc.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\SysWOW64\locator.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\sgrmbroker.exe elevation_service.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe elevation_service.exe File created \??\c:\windows\system32\openssh\dfdgapod.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\SysWOW64\tieringengineservice.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created \??\c:\windows\system32\cjfopmfe.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\SysWOW64\msdtc.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created \??\c:\windows\SysWOW64\eofglcfn.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\SysWOW64\perfhost.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\SysWOW64\sgrmbroker.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\sgrmbroker.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\Agentservice.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\vssvc.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\sensordataservice.exe elevation_service.exe File opened for modification \??\c:\windows\SysWOW64\alg.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created \??\c:\windows\system32\monaqeho.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\msdtc.exe elevation_service.exe File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe elevation_service.exe File opened for modification \??\c:\windows\SysWOW64\spectrum.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\tieringengineservice.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe elevation_service.exe File opened for modification \??\c:\windows\system32\snmptrap.exe elevation_service.exe File opened for modification \??\c:\windows\system32\dllhost.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\svchost.exe elevation_service.exe File opened for modification \??\c:\windows\system32\vssvc.exe elevation_service.exe File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\locator.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\sensordataservice.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\wbengine.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\spectrum.exe elevation_service.exe File opened for modification \??\c:\windows\system32\searchindexer.exe elevation_service.exe File opened for modification \??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\syswow64\perfhost.exe elevation_service.exe File opened for modification \??\c:\windows\system32\msiexec.exe elevation_service.exe File created \??\c:\windows\system32\bhlollho.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\bin\eiknqqhf.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\moiajbka.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\llhhlfmg.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\bin\fhmdllan.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\bhlnifll.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Microsoft Office\root\Client\icfmlqcp.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Internet Explorer\aglddoil.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\bin\gnciljmn.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\bin\fcbnjplg.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\odadaonc.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\bin\fadcmdcc.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\7-Zip\afaqkaok.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe elevation_service.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\bmmoojdm.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe elevation_service.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\eehkqlfa.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Internet Explorer\iodfapig.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe elevation_service.exe File created C:\Program Files\Java\jdk-1.8\bin\ckillgah.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\bin\qqlagjep.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\bin\phgiobhi.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\bin\jmdchbdj.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Google\Chrome\Application\onnmbqjl.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\bin\jeoonppk.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jre-1.8\bin\nikalpei.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\fnlcopje.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jre-1.8\bin\ibcoebjm.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created \??\c:\program files\windows media player\dkceeppn.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\klonohhl.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\bin\kfefgkli.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\djgnqiea.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\dmkcmlkj.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jre-1.8\bin\fcmpdicp.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jre-1.8\bin\ooqkhhjo.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File created C:\Program Files\Java\jre-1.8\bin\aplfnjfi.tmp JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\servicing\trustedinstaller.exe JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe - Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe 3956 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 1360 JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe Token: SeTakeOwnershipPrivilege 3956 elevation_service.exe - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer elevation_service.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" elevation_service.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_644e4d14dc2e71ecc9d70a2da540a360.exe"1⤵
- Drops Chrome extension
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3956
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2348
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:3448
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1960
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1980
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
- Size 2.1MB
- SHA256 898a2ff02092af06ad587e78e823a2784e55040b755c6af39123b5411a40c004
- MD5 00b7209c309570c5ce8e3a50f501edfd
- SHA1 b8491e2edada4c1e50a1994ad1549d4282511a9b
- SHA512 3cea806d4520d14f752ad4f8c127b563ac424727a356af685f9b3565fb1e09165a5cdd5716e2e9599c662803b8f9f64b27bc688929091cc92d3f7e75023bae2f
- SSDEEP 49152:YuYk3H5koURfTqkkYLO/W2buywzMbOX+T7z5fGqOa5RTgt0mtKXPs8MIk:YpfTqi90bjrOa6tKXU/1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 781KB
- SHA256 bb57d9cfbc3b9f4111bbb1c7e4e8bb8e2a2b65f56c7ae143695d9dc18e83509e
- MD5 17b062e1055982aea7fe639f67b33a33
- SHA1 30d3b8effbd8cc125b88633ef9c1388025f798de
- SHA512 6c063485994382c8ab23bd61c3a0a514afcf319143b50a2b226cf25c9b36aab60fe560ef6d52d8db7f787ec45260f309d0ee93bd21e80ac6960408b1e74accf0
- SSDEEP 12288:bsixPwEsHuXzRPgdxFV4p3ukxaJSgKMchyM/t4Ava3EgHq761PYyndwc:bZFwVuDRPQmUMMCl453Esq6Qynt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 9b45ce9c58dede2cc4c5170a0382214108937cd5786bcdcabc1aa8d58b434b8a
- MD5 3c6c9850d67dad538bf5e4ceea06623e
- SHA1 7e0f7cb4f3c1cea2b53545fd8233a25338e72ff4
- SHA512 a18e59c1c27f7b196678d202cab006cbf7d0d98dcc3ce976587bfa9d2d972801a9f60f5da638c744d91029b39acebbd2f6cab7a8afc435ab98b0e6d678fb6fbf
- SSDEEP 12288:y7a3iwbihym2g7XO3LWUWfh4CozUr2cWLI1u6uOgCM+8HxkelnFBa+mjqhnyj0cw:b+gkEofh4CoC2cWLIEcgJxkexmMyjf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 b895e7d3da5b13888d23f4dd98417f80f9d22a8b947c2b08b313cebf5ad1a851
- MD5 74ffb49eff4e2328ff1270b4010f03ec
- SHA1 26e5b586d6dea5179d86b68853917793cd689b0a
- SHA512 b9f5dc5f6ca0a4a5020f1d46aa4b90023dbd610bdfd6e1b8a225a32a6f7e6a94da20dcd82217fa839da9a9249913317f659d2e2da999eaf0d37a3105a49a59b5
- SSDEEP 24576:oBpDRmi78gkPXlyo0Gwjrzzzh126j4H5CDsVkrf+Djy1ZRC:8NRmi78gkPX4o0Gwj7P2Qy5usiaDjy12
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 ffe242b19dfbb45db12f55289d32d1991b927a9fb9baa6e72b2fbe67efea79a2
- MD5 1a3085653c40ba60cb5f09711f602a63
- SHA1 1c79da40998d83c34d28de29d5cdecb549f5100e
- SHA512 dc478151312e1a134a9ee7e14bbb9499335508e6843d9993c14de0f52276517072b96de2a66dac0a8dad6953412086c375d88c2bf9f7144633e4737cdd6d2bfa
- SSDEEP 24576:8LOS2o/PIXVQn6YTQChsHX3ZpW6BzrRsm6i/Qo:E//DpTQRDzremdQo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 832KB
- SHA256 4966a0a14b73aac3d332fe205dbe016f8a69c7226a3236b5b744e14e2f87778c
- MD5 7da83f9f541d80aadbff3f9338d5061a
- SHA1 2ed33a7d7577a946e263a8e7103a941ab61c34b5
- SHA512 9f27533dcb5b902a30247a652c7bbae1e4a9d24558ff985b6d04fe9e7a5e9d846550d4015ef21558edb4212b265df9156569ecf92602ac76ceec519e38d17a92
- SSDEEP 12288:DeBNUbTVO86UVNoMP8lJaiKJNkYdKPCQ7UOa:DJIUsDJaiKDkQKPPl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 1dc143d818ead09dbaa49f232dd6f4308ae8ef1973547e480041e2ae2c0f2816
- MD5 a203dd29dd35b8cc948f6c3a082780b2
- SHA1 b72df21a2a3a734ceb07a6339c42219d2db9e044
- SHA512 cd30798a36d5329db9efba459076a463b7270a3f9922a5c2085439a43cee0e358e44317b1f3f25fd94bd09e8bfef52403364bc31fa18261eed20940607db51b5
- SSDEEP 49152:mQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJQ9DN5J8NRV3THj:mQvGAdlCEL8c/QRNw5CHB5uy1t/v
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 898KB
- SHA256 5bc8bf66ceb23d05c6dabaf7c0ca4573d6e738f98ef0ec23b9c58ce317d5162c
- MD5 413707758bcc8ca01d18edf949e36732
- SHA1 e382175cbb5bd835d1f3e386aeaca0775533c12b
- SHA512 5789cd26df5bda22921d0701812d420e59353dbb8b4e2ad2e7c6700e50f3aea1df96864c18c5e9ba942809fe4af093bae7136ebd6403a6f334d3a551b9393bf2
- SSDEEP 12288:ZAwSfxL/2Dc38DLLmt0LDQewsAj2zfe5i8d2p25XxEQgueNhZUIN2Y70ZRARUvJM:KpewsAjSWFJlxX1eNfR2CbUG/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 96b1b067dd084b14eab6837848a28b5236c302918ba433b098d61faf5c2af610
- MD5 261dff7e2665c08c3a3acd745dded40c
- SHA1 1c34b8943fc3e63170b8f0e12af858fa7010e768
- SHA512 04d3af4e19cfd907576cec64b723a787073e71170d97e38c4ece36bb8833a674d28400d75e64694b7eff3ffc5d7e9753d30d6d6ef559b627c89d606dced5d976
- SSDEEP 196608:8UEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJHA:8UEtQevvqc2W1cpV29I32A
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 67dfa4a16b9fda06d8a05d2286b7bedfdf9a7fe0f5ce9e678233eeb9215a45e1
- MD5 c576286886fb447a9d57ac1e3c90d9b8
- SHA1 e75036bf619ccdd7b1c465691bfbd370f25a141f
- SHA512 5428634d18d2377ef47898c49bbacddb370fdbbbfa6dbd87569e7f6e42cf45a457b3852e699dd2687bdb7d5807d95d75fa1d6f7ce6010ea99f74d90ef79df14e
- SSDEEP 49152:DCbRquA/m2yL5zUfFiV+XenmE3/z4Xp9H9PsG:8oqpVjnmd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 797KB
- SHA256 1021c03eceb59a2b06c0fbba923f69e76d5c5be9e752147859d42be24d852d47
- MD5 4a5ae94735306ce1f8b596b29cccf414
- SHA1 4cffcc7d990a26d9c04a94f70e1b5483f9e5d6ed
- SHA512 b6a297962896a243a15bf0da50f594d0f3630927c86d8a6026654df177f4907f874a89b1d8ced06cf383f2c0ec52d82f9d3906fb570ffb727e67ae05ba6cd638
- SSDEEP 24576:bwuYOWISshuqjcaCQoh31aBk7FlktAzr:bwPOPB3cafG1aBkA2zr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\cpkcoelj.tmp
- Size 4.6MB
- SHA256 f0c9f20f01c8dde26ec798c5aff2b9e085b21d4692f771e25b214e3b46f5f14f
- MD5 f7bd44ddea55feb9d7ff663ace8db142
- SHA1 14c4c7d466c3201dfc43533ac1179b92729c7a14
- SHA512 b40d872e07dcbdc57f21a6a4228c98744d4ec33449bf821e9d5fb6f1c0dd787f28cb91339321fbd7430fe36bf7be0fdb8a1a7f414cf2126ed7314751a503898a
- SSDEEP 49152:tyEKQ5E3ieGR0PEtBFUow1b89eX61P+2xmepn/TRijbqYW3qkCbDypSfe6qwiXEg:xq9ceqp+2xl/SSayW/C1Asf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
- Size 2.1MB
- SHA256 62acf5047c7f408dc1b0170471df5bbc3852c11715d30c7dc447cdaaf183a9c1
- MD5 610ebbf01f9293e835bad92c8e142ddb
- SHA1 66b7332b2e52f8008f4b59485f771fbea5d7f71b
- SHA512 2b6b74bb2561148f6d402711c9e8019ca14902c24c61ccfebf3ad243f1a88bd284f6254127040c87c3ef6216a640442213746176b23fad8f30fe75cde9240a86
- SSDEEP 49152:G59PYHvI7wi/2IKuLFrFXlMWGxbgQlzXNUhjf:GGg2IKgMzMf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Internet Explorer\iexplore.exe
- Size 1.3MB
- SHA256 330edf0ecd72713d91e50d4655d6e2be2d403218a8161d8055ddaaf4fc307769
- MD5 ccdce701d069517748939362c3e305b0
- SHA1 a3a9f6851bd43c372644ccb6f60796505aa6048a
- SHA512 c635f2f66d068d015852b4cd9744bda5e7d7e7fe9cf066e1fb5032d346b1e9072f0ff95de067c8b760d9ecb0c329bc82a127754603e1df3030382eaf05b99c54
- SSDEEP 24576:mef4lGLbMMHMMMvMMZMMMKzb6XmMMMiMMMz8JMMHMMM6MMZMMMeXNMMzMMMUMMVI:mIMMHMMMvMMZMMMlmMMMiMMMYJMMHMMr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
- Size 978KB
- SHA256 9c9b1fe48004cbc4e56b7a4ee9f7953d466d04e1fb9d5be9b01ccdb2383def2c
- MD5 f8689e9dcd03542ce0717d8fc420126d
- SHA1 489a4805c86b85f26518f2f9035aac93d9037d83
- SHA512 017bc57a10637d2730a0d13dba53e471be31d61a32dd23f74215399bdf9e39ee8c1ff8714152c3fea2d123af51901fa42e067b33672dda4e9e649cad20a1bf64
- SSDEEP 24576:xiZwW2KjJ4Td3kJnbsPhnzqJNfwSG7F3hUeB5cNBTelZE0WJ:+bnJ4Td3mbsPhneJxwpNhUeB+NJelZEL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 932KB
- SHA256 79f6d3e9c709771397fe91067886b715eb4b7b8e15c270ed3ce3245bb08528f9
- MD5 75a686e07568c4b8f45938453ce41bf9
- SHA1 65b37680ba556ec685bcc566b76fa1fff3318815
- SHA512 cb1f4a32e44a3079734270e6cbf4d88b84570b875bcd27ccee606c6546e40fbd96c75d652a0ace5d21c399543c6bf469244eccc94e459168d57a3fa7b40fc46e
- SSDEEP 12288:gOb4A4LWOsvAYFT2T2mMk+Tq3uP1JSnZQ28eS6acNkDacbp:dwL3UTS2u3uP1JSZBS8kOC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\jqideopp.tmp
- Size 1.3MB
- SHA256 0d191f66d2c53188a9e32186a96f6963945999245e8f343ea9145c1d79ce9485
- MD5 c91efbe70bcf6e6ab27ead1eacfb2aed
- SHA1 e17e33ce05ab593309284abdb5ef6cda78cbc46e
- SHA512 924070091cefbe2da7fd521ad5651cc8520c55b6f1cd683da50a921a489133fd3702aef2097310efdf05373f6b302d853cf691dfb0419b97c407febae1a04188
- SSDEEP 24576:Y1QT7EcpfxR+N5AWAz3ooiYtjMqbFEjqPma5RWdgt0iWjyMJw525RGd:lTDxR+N5YzT/jMCGqOa5R2gt0P7q25R
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files\windows media player\wmpnetwk.exe
- Size 1.5MB
- SHA256 bf8daef3f769b628f473010ad0c48303126c8f852970fb3464c95339b9c5cb37
- MD5 230dbf6f7c86a439dcbd6e33884e215e
- SHA1 dc7b84ec737c0b43bb9b87941528a245fcef4a3f
- SHA512 068210af07bf03d0818a4a0e333872e3ac79e6a1d41ee94679dd7afe9327cf5d6a8fd8c06f12686719894d2e8e2ca9e47aeb61b47c06fe2e233d960563aa2c0a
- SSDEEP 24576:9cP4mcvIjkGOxhKP2l71cNKbrh/8KBT88uuNue4j7sjs0w:CP4m4IpOO67P8KS8uuNue4j7sY0w
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system32\Agentservice.exe
- Size 1.7MB
- SHA256 06afb74b30145d64722cbc3677dcf8c0e262f742be5fabb75739e8f9d5b4096d
- MD5 97efba296af37014ff3aac114526380c
- SHA1 ac80dc05dc7da24ca04bc26674df36a238e39d6d
- SHA512 97d13b5b96fc06928d5ffde4cab9704ff531c85c5992e2e4b1bedf61ba903f79e346287d60c0007d4d7c70ffd8748c6fc50acf37c1f490e1cf5f7c3945c0f1ea
- SSDEEP 49152:Ra0h2GEkuAe73q3ppC6zwwQjEKf3KP5gwTxz+QGy0siaDjy1jC:Ra0hNYGCJwpKf3a5gwTlYmDjMjC
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system32\fxssvc.exe
- Size 1.2MB
- SHA256 bcff342977d45520aafb85662e56a865fe0e3962a1839b1491dcb0ad1114e3f5
- MD5 1440c46fb43acc40d97d158e26bc8fe0
- SHA1 35efd35eb198c12dfd7b179c3fb26917de78b628
- SHA512 e494a76ec96bcc0ca2847b41a44b1ea87ca7fdf8ae01dee95401349706fa39cd6f256f8b71497c1e391b397765f7c3380d4497368d68823dbcd85cb5bc06ce70
- SSDEEP 24576:E3YgnJcRTk4yti+R5d6R/m+sA/+diFOyfXSY2q+V:EIgnaTk46p6R/mC+diFO2XSY5+
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system32\msdtc.exe
- Size 700KB
- SHA256 870af49d0987a236700c067942f898532bddf8e3a93c3d0d283fce33628f6fec
- MD5 cda3c46afebee1459d40aedf5a9c2bce
- SHA1 c4501c07821e7036f1f1252dbd0e713ef0000c55
- SHA512 b4990461971f208496282e309f44b2d7cd5e8cffd15e23b7872d80ceca278b63a286543bb4f16660570b3c8ba4646aa4202c32ad3471e6f4ac0692c83b14780f
- SSDEEP 12288:QjkyF2vTHOvyZapUnhGvD5+M7qho7GAGAzZbxdlgIESEkcEg2rYYS4t:QIyUvTHOvyZapUnhGbsM17GUoQgnY
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system32\msiexec.exe
- Size 623KB
- SHA256 a73ac7fe63214b9477af2df528019b14dbb9884f6478b74d98ff44d6217a4e4c
- MD5 310ecd35641978b91b6a2da276333543
- SHA1 8ec283f187402163bd936dde8d1abfe1f5b4cbd0
- SHA512 c5487ac59e99c586ecfb560f747533c5c93642da25d9375cb1d75a885782077e4281c1f28956dc708f4c7715b712495ae5acdb9a969647e740d5fc9fbd0eda33
- SSDEEP 12288:a45JM0jJeOndry3VnuuQHkKSWL6Qu48Ee3RdJRFbq4jU+:HJMQJ7c3FbQHmWL6Qu48Eedd
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system32\snmptrap.exe
- Size 572KB
- SHA256 a1c35622799d524ab9a5bbbdccb4c0d5889321f53290d88be6569b3db2ed7988
- MD5 446b984bd26c3a8073b803ed8e5f2d1d
- SHA1 acebb8ecb844f58cb222d930a362e251a5ad8ce7
- SHA512 a96dd0cc5962121365516a8b07a0508f29fbccfd3c885c2e2e8b4c7eeeb8d9ce3afcaccf2577d5f7abd05a02a8326cb04020027663e52e287ac5332503df49d1
- SSDEEP 12288:ZARpRec14B0kP79Zybc/NpbuGk4Awgp2FBa+mjqhnyj0cw:29ecu0s9Zy4RDMqmMyjf
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\windows\system32\wbengine.exe
- Size 2.1MB
- SHA256 98ebd6f6e5818bb03e7f81315179832f8b85b89046489dbff8561bc4743e3fc9
- MD5 f841108307481b37cde472ced0986c0e
- SHA1 6827fa3a011017c7b9051397d00840d85b266a8a
- SHA512 db60a3226356c983c4eda387627a7faaae3207be63417612ca36a945512b19a53dde39f394227c1c4a00bd683201dffe4e865de875dfb9b1bf3e14fa17aa176a
- SSDEEP 49152:4WcnPqQUGpuphwC0DNLDpaRFXrLuWGMKRIKtUnPs:a0zuNI
- MD5 SHA1 SHA512 SSDEEP