Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
11/01/2025, 06:44
Static task
static1
Behavioral task
behavioral1
Sample
JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral2
Sample
JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe
-
Size
409KB
-
MD5
f9dc45af96acdb35e2493f4c21684a2d
-
SHA1
ebaa57a261f3c0e78e63233f7c00e530d3d314c3
-
SHA256
5017fad3ad4cc8ebfae087439fd120d2bb6f89d8617421fa7cb672cd24a5694f
-
SHA512
7dff9f34edda24381d8d634c111890f72059f47fea844e25675fc396e2f2a6600adce93193824fc9d5dc9895617e05e76e1377c5cf8c6840804008d4e907ad36
-
SSDEEP
6144:ppMM8EV1kmIOA9nkEamR4XOyV5R7Ls2dMQRcR0FZXpL:URmqkjmR4BVH7LSQRlHL
Malware Config
Signatures
-
Contacts a large (1386) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@" JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\tcmsetup.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\driverquery.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\msra.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\mfpmp.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\wermgr.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\cttunesvr.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\extrac32.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\regsvr32.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\setupSNK.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\DpiScaling.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\hh.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\mobsync.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\srdelayed.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\cmd.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\ComputerDefaults.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\sdbinst.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\sfc.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\dccw.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\IME\IMESC5\IMSCPROP.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\setupSNK.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\IME\shared\IMEPADSV.EXE JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\sc.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\wermgr.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\msra.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\cacls.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\wowreg32.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\Utilman.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\dpapimig.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\rasautou.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\subst.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\auditpol.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\Dism\DismHost.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\isoburn.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\InfDefaultInstall.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\shrpubw.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\wbem\WMIC.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\cmdl32.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\diskpart.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\IME\IMEJP10\IMJPDCT.EXE JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\PkgMgr.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\runonce.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\autoconv.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\migwiz\migwiz.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\SearchFilterHost.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\wecutil.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\AtBroker.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\convert.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\hh.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\gpresult.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\vssadmin.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\SystemPropertiesComputerName.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\wusa.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\icsunattend.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\ieUnatt.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\MigAutoPlay.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\control.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\SysWOW64\dfrgui.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Common Files\microsoft shared\DW\DW20.EXE_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jre7\bin\servertool.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Google\Update\Install\{0AC99519-0FE0-4797-A0D6-2C21B93D4350}\chrome_installer.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Windows Sidebar\sidebar.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jre7\bin\policytool.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Updater.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\DVD Maker\DVDMaker.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jre7\bin\rmid.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Mozilla Firefox\updater.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\java.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkClientCP.bat- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jre7\bin\jp2launcher.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\template.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Internet Explorer\iexplore.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jre7\bin\jabswitch.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jre7\bin\tnameserv.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Windows Journal\Journal.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Internet Explorer\iexplore.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\kinit.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Java\jre7\bin\ssvagent.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Internet Explorer\ieinstal.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Microsoft Games\Mahjong\Mahjong.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Windows Media Player\wmprph.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Mozilla Firefox\firefox.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files\Mozilla Firefox\updater.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Program Files (x86)\Internet Explorer\ExtExport.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\wmpshare.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-runas_31bf3856ad364e35_6.1.7600.16385_none_bbdd3aeb771e694e\runas.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_microsoft-windows-cleanmgr_31bf3856ad364e35_6.1.7600.16385_none_6d1a8c84bedf66a4\cleanmgr.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_microsoft-windows-recover_31bf3856ad364e35_6.1.7600.16385_none_85e9a3f215ee94e3\recover.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_microsoft-windows-sxs_31bf3856ad364e35_6.1.7601.17514_none_b0540607b5e5d445\sxstrace.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-fax-service_31bf3856ad364e35_6.1.7601.17514_none_0b499f2c96e8f6b2\FXSUNATD.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-lua_31bf3856ad364e35_6.1.7601.17514_none_047062a1736af5b9\consent.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..ommand-line-utility_31bf3856ad364e35_6.1.7600.16385_none_fd9ec705e687f8c2\WMIC.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..pdateclient-activex_31bf3856ad364e35_7.5.7601.17514_none_af500e3c7fc49bc4\wuapp.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\wow64_microsoft-windows-ie-htmlapplication_31bf3856ad364e35_8.0.7600.16385_none_da5dd271ce714fff\mshta.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\f4a88265ac4ad47978daef8c5482fd30\MSBuild.ni.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\ehome\ehexthost.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-chkdsk_31bf3856ad364e35_6.1.7600.16385_none_1ddb4b87a6618437\chkdsk.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_microsoft-windows-write_31bf3856ad364e35_6.1.7600.16385_none_5f5928533e6b72c0\write.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_netfx-vb_compiler_b03f5f7f11d50a3a_6.1.7601.17514_none_144b6bd462e4a41b\vbc.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\wow64_microsoft-windows-notepad_31bf3856ad364e35_6.1.7600.16385_none_d5642974be118415\notepad.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_aspnet_regbrowsers_b03f5f7f11d50a3a_6.1.7600.16385_none_ddef5417d55eb944\aspnet_regbrowsers.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_microsoft-windows-ddodiag_31bf3856ad364e35_6.1.7600.16385_none_362ce835fe42421b\ddodiag.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_microsoft-windows-winhstb_31bf3856ad364e35_6.1.7600.16385_none_28dc647c6aba6742\winhlp32.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_6.1.7600.16385_none_a749cec7a8b6bf08\wbadmin.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..otocol-host-service_31bf3856ad364e35_6.1.7600.16385_none_e63ed98817cf16b1\Eap3Host.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ie-gc-registeriepkeys_31bf3856ad364e35_8.0.7601.17514_none_a0c922c3b170dd5d\RegisterIEPKEYs.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ncetoolscommandline_31bf3856ad364e35_6.1.7601.17514_none_bf4980401574a899\logman.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-xwizard-host-process_31bf3856ad364e35_6.1.7600.16385_none_b4e9027a5234f127\xwizard.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_msbuild_b03f5f7f11d50a3a_6.1.7601.17514_none_0de23daf595f5711\MSBuild.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_divacx64.inf_31bf3856ad364e35_6.1.7600.16385_none_cf37cc4c5bc25dc7\xlog.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\wow64_microsoft-windows-coreusermodepnp_31bf3856ad364e35_6.1.7601.17514_none_df7c5af777ec4541\drvinst.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\outicon.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..yer-sideshow-gadget_31bf3856ad364e35_6.1.7600.16385_none_841e9494c8a32794\WMPSideShowGadget.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_microsoft-windows-certutil_31bf3856ad364e35_6.1.7600.16385_none_b55b5e1094b0283d\certutil.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_microsoft-windows-servicingstack_31bf3856ad364e35_6.1.7600.16385_none_0935b76c289e0fd5\poqexec.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-systempropertiesremote_31bf3856ad364e35_6.1.7600.16385_none_f0ca3430257ea13f\SystemPropertiesRemote.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_microsoft-windows-net-command-line-tool_31bf3856ad364e35_6.1.7600.16385_none_5208a7a3d3caa54c\net.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\ehome\McxTask.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-format_31bf3856ad364e35_6.1.7600.16385_none_827dd459a3aa9980\format.com- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_caa8f7c0e409a91f\ntoskrnl.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\PrintBrmUi.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-servicepackcoordinator_31bf3856ad364e35_6.1.7601.17514_none_92e727843e307e1b\spinstall.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_microsoft-windows-diskraid_31bf3856ad364e35_6.1.7601.17514_none_67910dfbf63c4aae\diskraid.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\x86_microsoft-windows-r..eak-diagnostic-core_31bf3856ad364e35_6.1.7600.16385_none_5ae7f926deb5de01\rdrleakdiag.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-anytime-upgradeui_31bf3856ad364e35_6.1.7600.16385_none_4aadf3be188c056d\WindowsAnytimeUpgradeui.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-convert_31bf3856ad364e35_6.1.7601.17514_none_fafb502abef1be40\autoconv.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\msil_presentationfontcache_31bf3856ad364e35_6.1.7600.16385_none_0da126f11187fafa\PresentationFontCache.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_6.1.7601.17514_none_c79aef32ab85d92b\cmstp.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\cagicon.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ktmutil_31bf3856ad364e35_6.1.7600.16385_none_e47ee9c51ad9df17\ktmutil.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-r..-commandline-editor_31bf3856ad364e35_6.1.7600.16385_none_8d8925a444607f8c\reg.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\write.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\Boot\PCAT\memtest.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\ehExtHost32.ni.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe- JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-ehome-devices-mcx2prov_31bf3856ad364e35_6.1.7600.16385_none_3482237b32c1daff\Mcx2Prov.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe File created C:\Windows\winsxs\amd64_microsoft-windows-getmac_31bf3856ad364e35_6.1.7600.16385_none_67f38861bbac1910\getmac.exe_ JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7CF8E4C1-CFE7-11EF-A4F8-F6F033B50202} = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442739729" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004c7416f7de2a7c46ab281cd434ab62ca000000000200000000001066000000010000200000004d50797581ccdf4b58e5c36743edd74c006832f06e710e8c3454be664f8a1fbd000000000e80000000020000200000006ad40784ba51e43711a6e3b0a1cd8beb15e177cd5eca2b96af09436559bbd8a820000000e3153a2622e391835e1d4c012f3e66896380e3350325e563495102ab72846b3f40000000f9df24832a8f7a2e8936444493c9e068c905e9bb5ecf077cebc6c3d69b02728dbd4433d31b53851fec3c9eaa16858db8b75019616a3b4144f1dfc41be75b5bd0 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.exe Set value (int) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30a8966af463db01 IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.exe Set value (data) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004c7416f7de2a7c46ab281cd434ab62ca00000000020000000000106600000001000020000000658acb7a5224b880097684e317071ebc1db5c95362fc7bf6a39534211a0230d1000000000e800000000200002000000007eaa7b82246768dd6802bac4ef14b83dbb439bd42c9c26c75a064e84dab9999900000008060098c71e809a690bac25555662acb49674c46072f21d0334dd994e2aa4c08fb63d02c3631916c21a2c0152c3d039a30920cd32435726fbb857685a36cffde05bc2f67288585d0ed3998863336a84fe3df8cb9ed87adbac40f5802eee6740a7d44e05398e1b669a1ea1df63cc90182bb3aa4099ff1a67162beb3b0fda4414e265d795ddf5992c646d26f626d64d30240000000846a6fbcf813450a1c4d314e9bc64678de31028b766baca3d72c485dfa1881bfbe25f93bebd437152ab70e365e46395c7fb0d26ee1d07d02db643f65d604cd9c IEXPLORE.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2464 IEXPLORE.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2464 IEXPLORE.exe 2464 IEXPLORE.exe 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 640 wrote to memory of 2464 640 JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe 29 PID 640 wrote to memory of 2464 640 JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe 29 PID 640 wrote to memory of 2464 640 JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe 29 PID 640 wrote to memory of 2464 640 JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe 29 PID 2464 wrote to memory of 1388 2464 IEXPLORE.exe 30 PID 2464 wrote to memory of 1388 2464 IEXPLORE.exe 30 PID 2464 wrote to memory of 1388 2464 IEXPLORE.exe 30 PID 2464 wrote to memory of 1388 2464 IEXPLORE.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_f9dc45af96acdb35e2493f4c21684a2d.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Program Files\Internet Explorer\IEXPLORE.exe"C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2464 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1388
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
555KB
MD5da05bb10c81694b404181a8b8c4c6598
SHA10594eecf014396de61d52c8df2fd3858dd463474
SHA25607be20c032bc2795d04a4856cc7785ab1352342e7e8ed262679af081e3b00ec1
SHA51227f96ee03a77846aabab3a872d7946c7b4f517e4366dc7ac24784f29205f19a341d1477a91c6b6313a489d24328ef64cce286dc816e58ae07d73eba61155ea85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD599c74edf0f945a3c249b5a35d0c03df6
SHA1d44081a2a47048db93199d408cdd9eed500d444f
SHA2562efaaabe1204f80d295efbf8963033ef93cbfc6201b9c4325ddd5a0c79e4be94
SHA51216482e32a1bddbaadbe0dff10692d30a85c24ec0f04293dc1f87c606985015da5f827023f3e36eda68321cf50dd3a724a3154e1095e03aff5f7745dbb840375d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc3ea2a34c842233a65ef9d15828646f
SHA1738ec52893f8624a4b93bba9d26462b72aa444c0
SHA256ffcc1fd7b36fcd9f56492f392e82d4360cdeabb68ed193298ec65e987e767239
SHA512bb81a66c2bdbf284a8faf754d73ae8ca50fa2afde6e5279fb8be868c7a3484c70b649a66398109182b942acb2a83b169bef15b59c2ae91aaea1b80e2cde3a526
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a417f00ecd3bdc81dd1e13d7720059f4
SHA1804110295d012165b5c92ed4bafdb0490475db09
SHA2565712f3bb904492ef3e3d8777ddbaad6e5979cb47002f5d8992cc129e0f1386a7
SHA51228f98037a72770165f2129710e56dc6b479a43472f32a17e59540ac385f08502f4b38a89198339d2828cd5948104446f55cf58216d3b7cbe1afab38afdcf3c14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c7bd25d99484de2ebfeb2491b93b9d7
SHA1dc09a501e1c66025d96780d1c44fe6d0b7b93e59
SHA256dcfd54f628ba1644666323b7e86fc89f7d9f91fd6c11d2cbc4309117921f9925
SHA512367d7069dfddee0997c57b06dba01c0ac3aaadfb3bd77568dad550abd4df4a8d88527b4192ea6a519db408d9a508b33d6b52bce373354a89f62aad3a0547af3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca67fad6b49f13ea44bbe710ad6b773a
SHA13bd9d43a2576df85cecd81b113da5efb9e527052
SHA256c5019a19681da8030a0ef03438e07110a15df1ca67faf69a87a9426c85f4a370
SHA51271c1c81afd4a105e61c5af21bd394aefabf9d396b037e0f1d3f05ad6b59df8527e9f779127a0efb5359099474f4c8a3870cef562ad1d92ffeed840c40180644e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5694b8b7f218b6bef5ffa5414a29bd228
SHA1a016a8d56c5b189abad3fa4df41b9e6be301c1bd
SHA256d1621ef96e2af0dd84db4b274d73d227ca8dfda4f9a8f9fe4ec41a1cbddfa574
SHA512f421210e739968deb8c1e279c188aec4a3edc036c6ef5017db85a6c8234116c2f4f37cde714b1a85126b1b6db47e74f9c1fb6ea8cfaa3cdf3c42814dbc9552cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52dfe9bbfd52e69bc1d81beee664182dd
SHA1602dcaaecd772020a922cf19cb29a2ed17f60d38
SHA256bd7bc681fc61a32ec790eb0f785091f54ac53e026e6e3e5a64c3088873e781be
SHA5128a45c9a5d07900fe0fcead4cb32ba0c9e897db36c6828a9fa383f4ac3992355bddb366e1977afdf42c7a252d9abf526f2b06a357e0d845d3635726a5d1f9cd59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a037b30b1cc5f3ab1b83c18687be4c6
SHA10ea26fe70ff93e34d4608782055d8fa611304ec5
SHA2565477c001e194c76d09794aba2070e8501f9486c768dc8789db7546e54dd4fe62
SHA51283ac7bdfa5aa0cdb6c531031fd4898a673b672c569bd54d0ef092806ad9852825d3e7ffd0ff98a1afdb66188feff17fbf887c4bad38070ad9264da19aef283d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a14d1f1c21cd1cc246725b74afb345e0
SHA1abfb8b6d2d5c9ea846f5d042f7043aa8090cfcb1
SHA25643cd91f183aea53eb5b8f2c0c1ba007b4aef685040e74d88b10268b1f7e16f6c
SHA5121eb0f58efc51c1d600eac381741ffb4b6a4cf7528305ba464fd550a032351a8e922a3b687dd74d64bcf8bf5f816ad63a5146d264e3f668161b0497c684246753
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dd4cd943e20bb0d558e82b6d9ba0bdce
SHA1119b39e2700ebe8eca3e12c3a319678c9ebf98e9
SHA256a097effafa5958b4b1f6664fa6aed1e03ebe2e41ac4d8df681198f9fb1e5c725
SHA51284f8f65d62e3b525fd827b3677fbff06987b56ac9b0f2a42912243377ab2abf39c316f0b2723ec164d97ae3e27bc34778b0b52f5dd8bf111af35926a323d2dc2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50053d7070b2e97f40efbb2b5bb177b70
SHA195f47bb51be08babe4a7cdd0e958d6dfc4fe4bf3
SHA2567bef0e5f1bb8fd59aabb9491b8cea50b49cc60686b75ca019a9e1770533d35a0
SHA512d194111ae227ee97252df18267935ae664a2a3ffcbd7cf46d2b1734a96ad2f6b6c44c1cbe086a2f75e12b9b51a3c9f22dbad53b8711c3e751a1de49fea1e9db4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f69aaafbcff2068a1f469b3bfb53df2
SHA116b136c7b7822252265da083631c435faa09edbb
SHA2563eceb19249dfddf11ea74a406a5ce8c6f22ff589baa8ec801382cf7da66be041
SHA512857ce027b1c0e9aa354de3dcde7bdae0945a7bf4e5f2485220bb3496ed8945f105ea5deec1814fb7446aa230c7241906f56b702a3a25f9d074324384e55d9d16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51498e40a63451bec4d2bc6dee7006e20
SHA1a67dd5f0ebf15fd12fb50bf4b483d3e834136ce8
SHA256676919ab5480219c0a2f289a36fa30c05c47d4def91ca48db7f769a07ba705d3
SHA5126db6930645b4e074d565b7a85dd2979e077034b1a48a671886b35f3a4486d4d56f842ec0b180dc6e43adce760b4bd18c5222b8faf19c11f0f9ca30a553b3d8c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5627247a1c51867ce0404b01ed1b696bb
SHA1f9b3b6dcbca6aaff30ed2799c3118161c363f079
SHA256932aca1c6da538cb9393e4d78b5852a674b87764c85a89ec90b47c45fd4bddda
SHA5123a5c70e922fbd051f2376fb80155648fae8bcae5e030c709dc99f3b4ac9ca64bcfb1bd2911e5d1177371c90859cfa80758d539702774f0880391960818995acc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5917c9e6ba1d6b39c9d0c8d9ea9416475
SHA1234c731a6fb468429c1ea2a8126d85919787f35d
SHA256cdb25274dc183659ae7087f9ade561cebf007377805e4eaa9b7a9209fc7ad6a2
SHA512e74e367f1c52cad94f74e74ab7737cfeb93b5565fab67d89a7a710184b4ac074f1f67319de4415d204e5acd3d60f0def4dbc3049628b0f5105727866f87a7570
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD568779f2fe8f8d5be625bbc75a2c61b0d
SHA18122e7c06e73f71968f44dcfdb013cdca04f0037
SHA256c6c54c52874f78992cb95a6a03be4bad0b64c9a90382c6970b65bcc6110a5027
SHA5127e5f02c5ec8aa12ca60ace21ed660f039cd1b4e80d9b9ace0fbd20ed9ab05f17ccb9bb10d7aa423fe730dc20c81ceadcb6ab80e29aa6c38869dae9de188f83c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc31aa18513503eb63ece711d03aa226
SHA196a9f5b7ba128edfc6b8a632430fc0c53dd067f7
SHA256a373986ac86c5cb7c7ed56d9288a3f14deceb92681405e28649105de8c0c8a9b
SHA512dceb65cf671d84910fff6eabfbe337ec4cc4c638e4f6476ef4d901745183be12990f58d4a5cc4c6f0ab0a36c668086bc76a5ddf2201c3bd46335ca9d8cc2be7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2e06672dfcb8cf27de29bd9503efbda
SHA17863ea481a88dcad3cdd205312d6d50fadd97c69
SHA25639f11d31206a0b22575ada347ef1ca2c0c2b1d95232c96f9886c7821bafabbbb
SHA512aa021fc60cf77f7883f4323b6a460313ae1c19f0f79b5be5330c7dc7dd96faf97a734ed5870234be8d3ef50d9ff03e2d9d5567269a3bc103095bd5c47b5d03b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2e34766943062ce5b46458cfffacc67
SHA13697cb89f0047bbfdc9038031f9e2e7614dddbe8
SHA256de6ca181b0c9f9dd2306378a4f037f6cb38d4daebcc32220e4906272d9c8795f
SHA512398572867679d2129898371160d6b7ac6ae7336ad1826a319579873992bf2142c0ec32e0219f2afb727ef01fd37e7755d4475c105d2f89e97549b14d02cccc4f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b