cycbot | 36276e5e68bc38e5b0429b8dd7f085ea777f3a24f41ce7dfb954788fde6b0c28

Analysis

max time kernel
149s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-01-2025 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
Size

807KB
MD5

6c0aa714f3be6eedd63bcbd1569518d9
SHA1

2c8348912a3efe95e454b638751f230281d32716
SHA256

36276e5e68bc38e5b0429b8dd7f085ea777f3a24f41ce7dfb954788fde6b0c28
SHA512

e068549f27bf890079d219197876cb1e25de3e8ce38470c35143ac50db2caf98ef889fa53fda3620458ee53313fffd21f8c581b5b3e57f94b0019f82cdd668ed
SSDEEP

24576:FYkjlogR+tmbs1t9qgYohxfloUZhjaoJKwbgy:FYsohtmMKcoUvPJKwbgy

Score

10^/10

cycbot modiloader pony backdoor credential_access discovery evasion persistence rat spyware stealer trojan upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 2 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/608-115-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot
behavioral1/memory/1596-139-0x0000000000400000-0x000000000046B000-memory.dmp	family_cycbot

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	eQDewf74.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	keeajo.exe

Modiloader family
modiloader
Pony family
pony
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

ModiLoader Second Stage 9 IoCs

resource	yara_rule
behavioral1/memory/1224-10-0x0000000000400000-0x0000000000417000-memory.dmp	modiloader_stage2
behavioral1/memory/1764-13-0x0000000000400000-0x0000000000515000-memory.dmp	modiloader_stage2
behavioral1/memory/1764-15-0x0000000000400000-0x0000000000515000-memory.dmp	modiloader_stage2
behavioral1/files/0x000a00000001739b-44.dat	modiloader_stage2
behavioral1/memory/2648-68-0x0000000000400000-0x0000000000416000-memory.dmp	modiloader_stage2
behavioral1/files/0x00080000000173b2-71.dat	modiloader_stage2
behavioral1/memory/1808-89-0x0000000000400000-0x0000000000416000-memory.dmp	modiloader_stage2
behavioral1/memory/1764-102-0x0000000000400000-0x0000000000515000-memory.dmp	modiloader_stage2
behavioral1/memory/1764-363-0x0000000000400000-0x0000000000515000-memory.dmp	modiloader_stage2

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Disables taskbar notifications via registry modification
evasion

Deletes itself 1 IoCs

pid	Process
2008	cmd.exe

Executes dropped EXE 13 IoCs

pid	Process
2248	eQDewf74.exe
2864	keeajo.exe
2648	aihost.exe
2592	aihost.exe
1808	bihost.exe
2772	bihost.exe
608	cihost.exe
1996	dihost.exe
1596	cihost.exe
332	csrss.exe
2784	eihost.exe
1956	cihost.exe
880	8315.tmp

Loads dropped DLL 17 IoCs

pid	Process
1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
2248	eQDewf74.exe
2248	eQDewf74.exe
1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
608	cihost.exe
608	cihost.exe
880	8315.tmp

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 52 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /q"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /F"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /y"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /i"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /H"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /c"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /S"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /s"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /w"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /v"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /j"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /P"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /h"	eQDewf74.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /l"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /C"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /V"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /J"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /u"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /Q"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /n"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /e"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /h"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /K"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /E"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /g"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /k"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /a"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /p"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /d"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /r"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /Y"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /z"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /M"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /o"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /T"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /D"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /B"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /G"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /x"	keeajo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\D5A.exe = "C:\\Program Files (x86)\\LP\\8E30\\D5A.exe"	cihost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /Z"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /W"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /f"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /O"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /A"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /I"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /U"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /N"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /b"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /L"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /R"	keeajo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\keeajo = "C:\\Users\\Admin\\keeajo.exe /m"	keeajo.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	bihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	aihost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	aihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	bihost.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2596	tasklist.exe
3060	tasklist.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1224 set thread context of 1764	1224	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	31
PID 2648 set thread context of 2592	2648	aihost.exe	39
PID 1808 set thread context of 2772	1808	bihost.exe	41
PID 1996 set thread context of 2876	1996	dihost.exe	48

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1764-13-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/1764-15-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/1764-12-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/1764-6-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/1764-4-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/1764-2-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/2772-91-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2772-94-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2772-93-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2772-87-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2772-83-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2772-81-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/1764-102-0x0000000000400000-0x0000000000515000-memory.dmp	upx
behavioral1/memory/608-115-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1596-139-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/1764-363-0x0000000000400000-0x0000000000515000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LP\8E30\D5A.exe	cihost.exe
File opened for modification	C:\Program Files (x86)\LP\8E30\8315.tmp	cihost.exe
File opened for modification	C:\Program Files (x86)\LP\8E30\D5A.exe	cihost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	keeajo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eQDewf74.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8315.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bihost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eihost.exe

Modifies registry class 5 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2248	eQDewf74.exe
2248	eQDewf74.exe
2592	aihost.exe
2592	aihost.exe
2592	aihost.exe
2864	keeajo.exe
2772	bihost.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
608	cihost.exe
608	cihost.exe
608	cihost.exe
608	cihost.exe
608	cihost.exe
608	cihost.exe
2592	aihost.exe
2592	aihost.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2592	aihost.exe
2592	aihost.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2592	aihost.exe
2592	aihost.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2592	aihost.exe
2592	aihost.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
2864	keeajo.exe
1996	dihost.exe
1996	dihost.exe
1996	dihost.exe
1996	dihost.exe
2864	keeajo.exe
608	cihost.exe
608	cihost.exe
608	cihost.exe
608	cihost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1056	explorer.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	tasklist.exe
Token: SeRestorePrivilege	684	msiexec.exe
Token: SeTakeOwnershipPrivilege	684	msiexec.exe
Token: SeSecurityPrivilege	684	msiexec.exe
Token: SeDebugPrivilege	1996	dihost.exe
Token: SeDebugPrivilege	1996	dihost.exe
Token: SeShutdownPrivilege	1056	explorer.exe
Token: SeShutdownPrivilege	1056	explorer.exe
Token: SeShutdownPrivilege	1056	explorer.exe
Token: SeShutdownPrivilege	1056	explorer.exe
Token: SeShutdownPrivilege	1056	explorer.exe
Token: SeShutdownPrivilege	1056	explorer.exe
Token: SeShutdownPrivilege	1056	explorer.exe
Token: SeShutdownPrivilege	1056	explorer.exe
Token: SeShutdownPrivilege	1056	explorer.exe
Token: SeShutdownPrivilege	1056	explorer.exe
Token: SeShutdownPrivilege	1056	explorer.exe
Token: SeShutdownPrivilege	1056	explorer.exe
Token: SeDebugPrivilege	3060	tasklist.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe
1056	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
2248	eQDewf74.exe
2864	keeajo.exe
2784	eihost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
332	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 1764	1224	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	31
PID 1224 wrote to memory of 1764	1224	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	31
PID 1224 wrote to memory of 1764	1224	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	31
PID 1224 wrote to memory of 1764	1224	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	31
PID 1224 wrote to memory of 1764	1224	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	31
PID 1224 wrote to memory of 1764	1224	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	31
PID 1224 wrote to memory of 1764	1224	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	31
PID 1224 wrote to memory of 1764	1224	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	31
PID 1764 wrote to memory of 2248	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	32
PID 1764 wrote to memory of 2248	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	32
PID 1764 wrote to memory of 2248	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	32
PID 1764 wrote to memory of 2248	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	32
PID 2248 wrote to memory of 2864	2248	eQDewf74.exe	33
PID 2248 wrote to memory of 2864	2248	eQDewf74.exe	33
PID 2248 wrote to memory of 2864	2248	eQDewf74.exe	33
PID 2248 wrote to memory of 2864	2248	eQDewf74.exe	33
PID 2248 wrote to memory of 2844	2248	eQDewf74.exe	34
PID 2248 wrote to memory of 2844	2248	eQDewf74.exe	34
PID 2248 wrote to memory of 2844	2248	eQDewf74.exe	34
PID 2248 wrote to memory of 2844	2248	eQDewf74.exe	34
PID 2844 wrote to memory of 2596	2844	cmd.exe	36
PID 2844 wrote to memory of 2596	2844	cmd.exe	36
PID 2844 wrote to memory of 2596	2844	cmd.exe	36
PID 2844 wrote to memory of 2596	2844	cmd.exe	36
PID 1764 wrote to memory of 2648	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	37
PID 1764 wrote to memory of 2648	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	37
PID 1764 wrote to memory of 2648	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	37
PID 1764 wrote to memory of 2648	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	37
PID 2648 wrote to memory of 2592	2648	aihost.exe	39
PID 2648 wrote to memory of 2592	2648	aihost.exe	39
PID 2648 wrote to memory of 2592	2648	aihost.exe	39
PID 2648 wrote to memory of 2592	2648	aihost.exe	39
PID 2648 wrote to memory of 2592	2648	aihost.exe	39
PID 2648 wrote to memory of 2592	2648	aihost.exe	39
PID 2648 wrote to memory of 2592	2648	aihost.exe	39
PID 2648 wrote to memory of 2592	2648	aihost.exe	39
PID 2648 wrote to memory of 2592	2648	aihost.exe	39
PID 2648 wrote to memory of 2592	2648	aihost.exe	39
PID 1764 wrote to memory of 1808	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	40
PID 1764 wrote to memory of 1808	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	40
PID 1764 wrote to memory of 1808	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	40
PID 1764 wrote to memory of 1808	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	40
PID 1808 wrote to memory of 2772	1808	bihost.exe	41
PID 1808 wrote to memory of 2772	1808	bihost.exe	41
PID 1808 wrote to memory of 2772	1808	bihost.exe	41
PID 1808 wrote to memory of 2772	1808	bihost.exe	41
PID 1808 wrote to memory of 2772	1808	bihost.exe	41
PID 1808 wrote to memory of 2772	1808	bihost.exe	41
PID 1808 wrote to memory of 2772	1808	bihost.exe	41
PID 1808 wrote to memory of 2772	1808	bihost.exe	41
PID 1764 wrote to memory of 608	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	42
PID 1764 wrote to memory of 608	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	42
PID 1764 wrote to memory of 608	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	42
PID 1764 wrote to memory of 608	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	42
PID 1764 wrote to memory of 1996	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	44
PID 1764 wrote to memory of 1996	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	44
PID 1764 wrote to memory of 1996	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	44
PID 1764 wrote to memory of 1996	1764	JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe	44
PID 608 wrote to memory of 1596	608	cihost.exe	45
PID 608 wrote to memory of 1596	608	cihost.exe	45
PID 608 wrote to memory of 1596	608	cihost.exe	45
PID 608 wrote to memory of 1596	608	cihost.exe	45
PID 1996 wrote to memory of 1152	1996	dihost.exe	20
PID 1996 wrote to memory of 332	1996	dihost.exe	2

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	cihost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	cihost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:864

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1152
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
  "C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
    JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Users\Admin\eQDewf74.exe
      C:\Users\Admin\eQDewf74.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2248
    - - C:\Users\Admin\keeajo.exe
        
        "C:\Users\Admin\keeajo.exe"
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:2864
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c tasklist&&del eQDewf74.exe
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2844
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2596
  - - C:\Users\Admin\aihost.exe
      C:\Users\Admin\aihost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2648
    - - C:\Users\Admin\aihost.exe
        
        aihost.exe
        5⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2592
  - - C:\Users\Admin\bihost.exe
      C:\Users\Admin\bihost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1808
    - - C:\Users\Admin\bihost.exe
        
        bihost.exe
        5⤵
        Executes dropped EXE
        Maps connected drives based on registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:2772
  - - C:\Users\Admin\cihost.exe
      C:\Users\Admin\cihost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:608
    - - C:\Users\Admin\cihost.exe
        
        C:\Users\Admin\cihost.exe startC:\Users\Admin\AppData\Roaming\081F8\DBD8E.exe%C:\Users\Admin\AppData\Roaming\081F8
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1596
    - - C:\Users\Admin\cihost.exe
        
        C:\Users\Admin\cihost.exe startC:\Program Files (x86)\F86DE\lvvm.exe%C:\Program Files (x86)\F86DE
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1956
    - - C:\Program Files (x86)\LP\8E30\8315.tmp
        
        "C:\Program Files (x86)\LP\8E30\8315.tmp"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:880
  - - C:\Users\Admin\dihost.exe
      C:\Users\Admin\dihost.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1996
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2876
  - - C:\Users\Admin\eihost.exe
      C:\Users\Admin\eihost.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2784
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_6c0aa714f3be6eedd63bcbd1569518d9.exe
      4⤵
      Deletes itself
      System Location Discovery: System Language Discovery
      PID:2008
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3060

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:684

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1056

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\081F8\86DE.81F

Filesize
300B

MD5
816837e724653ba09d8ef0d9a23f1789

SHA1
c00d73dfa593a82f44c4ed7f0c2274ba7326db28

SHA256
3bb60d0e8ce5dc52e931d778f30b30e21fd0c0812ad56dfd86bfa4ca05847ee8

SHA512
299162fc65d4d75f5795c0dce283440918c7558f4fad278e51b0190b701da065bb0d474708887ae1edcc8a53015219833e37d3962252d7bcbd8cd3755558483a

Download Submit
C:\Users\Admin\AppData\Roaming\081F8\86DE.81F

Filesize
600B

MD5
8f7045f5736eb05537a893120a49fa26

SHA1
8971e41c2512302fb08a6c1243029ea09afd9693

SHA256
9c74f1d64baaff0a4723d375fe9219713a43c1b6c9bf368c3bcead5eaac40c23

SHA512
67121681150c3e0bf8982abb73f659110bc93783b9a86dc81ede17205e6e0f59a0291a99d18eac826f8c5fa254aacbe581f0d85db31ecc1da6aa4ef9ee6a8081

Download Submit
C:\Users\Admin\AppData\Roaming\081F8\86DE.81F

Filesize
996B

MD5
56ef21ed45a2d80d7e068f2e8f9e2176

SHA1
d32c2f858787ba2b7eb6224bda4d62b201175f62

SHA256
66728784c3ed2fc0031df28655b2a6855d69b5f54db3b25de9a8c33c6e8aba69

SHA512
aad6120f1649507e654cfb1e0f462c8c97d06e6ad78bc8cbfe0753f81bb74c0abc235625111a0ef9ac37605ffe3369c1905a56b18504e70f2aaccb2d0b7fa5d4

Download Submit
C:\Users\Admin\AppData\Roaming\081F8\86DE.81F

Filesize
1KB

MD5
15f23bc11b7e2f9fda8f87d926b3f57b

SHA1
e93d51a0402d6aa341145d03f8ac79167e55695f

SHA256
a1378b50a8e94900041c1dec5f679c1bbffcd690065e9f92fe3261bb95e598f8

SHA512
7f923ebd9e24361356ae3285a988577aeca5cd6e15109b3d142cd8cb43b7dfff3dc8a7a1995512035cf69bbadfc8934a189a61554e045f6ae3baa49d0479114f

Download Submit
C:\Users\Admin\AppData\Roaming\081F8\86DE.81F

Filesize
1KB

MD5
77b57967749f82aa554b1abba287493c

SHA1
a2daf64a19226b18d09625dd8b0b0ff725e7f644

SHA256
65a3db3b5352c411bdcf73b9ca3fad326aa3256574cc3b826cc7ab82df0b1b3c

SHA512
47ffe39d7ca36ec0828d63ed40bf102895785e3f2d038c7c749a33d4dc4fd9c93b3239aa5ae9bafb552783092299594edc8bb2680cba3ffcbedea962d78df983

Download Submit
C:\Windows\system32\consrv.dll

Filesize
53KB

MD5
63e99b675a1337db6d8430195ea3efd2

SHA1
1baead2bf8f433dc82f9b2c03fd65ce697a92155

SHA256
6616179477849205eb4075b75a042056d196f45d67f78929dbb3317a35ccbea9

SHA512
f5b986eafa38dbc9ad7759784ac887ecbb9c8d8009a3f33e91b9c9ceeaf043ed3e4ddab8e6b6b77e54aed9fcecab02442c8ff253f2136ea06996d05ddd68199f

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
783e723a7b35075cb10d3f71387487b8

SHA1
5891f3661f4c33730ce54794122aa8597917e952

SHA256
5aaf936ed943f20d056f96a8ff29aa1d7594773aa5e8770ac6a219c9afb6d6c1

SHA512
e916989873dd9f6dc15d1f08120f58d76532ad22d61a66312047439fc3ae09caceb9cc326b77a99727c23908a4c1f39bcbca4acb49759b6f6204a7d923b817d9

Download Submit
\Program Files (x86)\LP\8E30\8315.tmp

Filesize
100KB

MD5
4c04ec47c44bc997519e18ce5f20e9d6

SHA1
680968fe85eaa19ac68b8dabf3371dd81684ed83

SHA256
446ddf0822deef56cedbfa0910143c744835ed765d128408d9ea994a569581a2

SHA512
e33e959e25d09152c1f64d60a7733f7c7a1dfd9f0bee6ed1f8aa18cf5e5248442e365d211c4555e0723b4e23e97c0a99d43b8fe6538cc9c77f0d39fd73616279

Download Submit
\Users\Admin\aihost.exe

Filesize
229KB

MD5
c7b9733430c4bf7f56a0c89d7f2dd9cf

SHA1
0a894c98e17a8c81a378a37c2230cf188932d21e

SHA256
8047916855a52a9b5e97c010e8fc2dc01a9ed91d2798a6869f8669ea4a92940d

SHA512
4aefe0746e896c00bc908128ba63e13d2abed9e839d13da14042365afb81d85bf75537292f7323a56694258ddec7a88b57202721b62651cfcbef2932c0cb2464

Download Submit
\Users\Admin\bihost.exe

Filesize
119KB

MD5
386fef8fdb975e7c102921910db7f9fb

SHA1
cdf3f86411189db08c8c0f887f26c2572ecc0889

SHA256
ae06d784c51702aff587d235d48de3b1162872069fac4602d921d023527efae0

SHA512
6ab8c2721c81bdff414e8cdbd7ca006abf3ed8c0155510d6c92555885038f33c1cf08372302b6465196f69aa15a7305fb05eb2e12026f1fc96a797646b8d2352

Download Submit
\Users\Admin\cihost.exe

Filesize
279KB

MD5
4df3241b8f53ad2d1c0bba6dc1b97e02

SHA1
f0c43893143a3442a453f56c9c4f740941b1d097

SHA256
407e0425757e28262c3054c1dc981a9f41cf83cd67ecfbf37d3b8fe74db54199

SHA512
e90e4a8b708fb9d3213f73e641fa39625a38fa969270ef1123206fb30d04837f018b9838aa02a234265c0b9ba765f567b748a7b73c437b96daba7a15e5e38663

Download Submit
\Users\Admin\dihost.exe

Filesize
244KB

MD5
88537f3fd69e60683c4467e89b7651af

SHA1
2c14a9010bed93b0622efe283a34de343ca33244

SHA256
4a7897e22ad30c516920e6441dc360a98114f15d9652b89909758f4966029692

SHA512
b3d070628092558770e08386eeabf69efc613ce163ce1f50cc00a81a78cbec6b667a84a4f09144b7f0c145ec28929b78deee4f7cab10ce7ac9a2f9c536ce8084

Download Submit
\Users\Admin\eQDewf74.exe

Filesize
180KB

MD5
42836a2ee8ce9deef8d846272ef3949f

SHA1
79f698c53e56c96c859a0155e02a24c93e120145

SHA256
5569f623253918233149531fbd49bd624af013695bf0f7d8b53ef58b062e6a37

SHA512
786802f71512228215ddac4d23a7eec6e8cfb8ab4c02ba0a03b06241431e70c202e845ce08222945f668218d91dd6630e9e5499be0b44fda7b3dc29e98231d85

Download Submit
\Users\Admin\eihost.exe

Filesize
28KB

MD5
f06f7a3945f4f78ee2c6d1ed35cbb5be

SHA1
ac1ab0f60a94286b6f01b40431e6f87f6e9899bf

SHA256
a2c720d07e18b73143b040ab817bad7da98ed2a262d55e6119b9cbd8b93dbbe3

SHA512
23f1fc1f15aab030c3d19a1c166479a52659b91dac00fff1301ddfd6e5e62279d45ec176f2e891098eb0d613d1f148952bf71341227b35f52c3bc2bf5fcdad14

Download Submit
\Users\Admin\keeajo.exe

Filesize
180KB

MD5
d3a31d13842de6848982e161212f959d

SHA1
20214dca9db64754a65dc2297caa2684e4424693

SHA256
7a6c1fec6a22db4b35c60fece23d24bde7c9dccf388ad49b64febf25be78a7a1

SHA512
13739e5f0c15750db9c38950b05ed24419e9e6558e1e21a9ba06e238a5c57f21a85988f19ce592d504cac9d5af5306f8e47f40622682b207925e5596a5670342

Download Submit
\Windows\assembly\GAC_32\Desktop.ini

Filesize
4KB

MD5
758f90d425814ea5a1d2694e44e7e295

SHA1
64d61731255ef2c3060868f92f6b81b4c9b5fe29

SHA256
896221147d8172197cbbf06c45d461141ce6b4af38027c1a22d57c1165026433

SHA512
11858e498309f611ee6241c026a402d6d979bffe28d4cbf7c9d5a89c3f3de25e1d253ab552ef7bc7cc43dd056307bd625e2e4f09beb21f0214c3946113b97ca9

Download Submit
memory/608-115-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1224-10-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/1596-139-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1764-12-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1764-102-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1764-4-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1764-15-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1764-0-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1764-6-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1764-2-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1764-13-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1764-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1764-363-0x0000000000400000-0x0000000000515000-memory.dmp

Filesize
1.1MB

Download
memory/1808-89-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1996-137-0x0000000000400000-0x000000000045D000-memory.dmp

Filesize
372KB

Download
memory/1996-140-0x0000000000390000-0x00000000003CC000-memory.dmp

Filesize
240KB

Download
memory/1996-118-0x0000000000390000-0x00000000003CC000-memory.dmp

Filesize
240KB

Download
memory/1996-126-0x0000000000390000-0x00000000003CC000-memory.dmp

Filesize
240KB

Download
memory/1996-122-0x0000000000390000-0x00000000003CC000-memory.dmp

Filesize
240KB

Download
memory/2592-52-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2592-56-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2592-62-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2592-70-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2592-113-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2592-66-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2592-59-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2592-54-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2648-68-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2772-83-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2772-91-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2772-94-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2772-93-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2772-87-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2772-81-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2772-79-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download