cycbot | 212abfa710a85ae8c0ded0f528238f6960b2d714106fc920ec639f25ad36ff85

Resubmissions

12-01-2025 13:10

250112-qef7dstkgz 10

12-01-2025 10:48

250112-mv9l4ayqhw 10

12-01-2025 10:40

250112-mqmxjaypcs 10

Analysis

max time kernel
900s
max time network
837s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
Size

667KB
MD5

0c9051fa83195d90120b21f47b895221
SHA1

34c4a5caa77f87bc1394ff9755c5bc78f35e1c9e
SHA256

212abfa710a85ae8c0ded0f528238f6960b2d714106fc920ec639f25ad36ff85
SHA512

f8b2b8290840998cfffb3745378b6b3536fe30e1e64c8421d748beee75ae59bf91130804bbf10b1c05157ec0f8cec947a4ff787b8de5f0bd6343330a713585fe
SSDEEP

12288:WbMqmNEEb4E9F/ATyGv4XKGQi2lJLm1Giizl6oAlpxElrW1A:WIzEEb4Ev/ATEXKGVnGTzpA1Ec1A

Score

10^/10

cycbot modiloader backdoor discovery evasion persistence rat spyware stealer trojan upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 6 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/944-102-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral1/memory/980-104-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral1/memory/2320-160-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral1/memory/980-162-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral1/memory/980-239-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot
behavioral1/memory/980-277-0x0000000000400000-0x0000000000452000-memory.dmp	family_cycbot

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3"	bohost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	DV245F.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	rtxaeh.exe

Modiloader family
modiloader

ModiLoader Second Stage 7 IoCs

resource	yara_rule
behavioral1/memory/2492-10-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2
behavioral1/memory/376-16-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2
behavioral1/memory/376-14-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2
behavioral1/files/0x0008000000017429-45.dat	modiloader_stage2
behavioral1/memory/2816-64-0x0000000000400000-0x000000000041E000-memory.dmp	modiloader_stage2
behavioral1/memory/376-78-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2
behavioral1/memory/376-275-0x0000000000400000-0x00000000004CF000-memory.dmp	modiloader_stage2

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Disables taskbar notifications via registry modification
evasion

Deletes itself 1 IoCs

pid	Process
2200	cmd.exe

Executes dropped EXE 18 IoCs

pid	Process
1060	DV245F.exe
2984	rtxaeh.exe
2816	aohost.exe
2624	aohost.exe
980	bohost.exe
784	dohost.exe
944	bohost.exe
2320	bohost.exe
2068	bohost.exe
2612	bohost.exe
764	bohost.exe
1904	bohost.exe
2436	bohost.exe
2080	bohost.exe
892	bohost.exe
2344	bohost.exe
2152	bohost.exe
2676	bohost.exe

Loads dropped DLL 10 IoCs

pid	Process
376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
1060	DV245F.exe
1060	DV245F.exe
376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /C"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /X"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /m"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /n"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /w"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /E"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /Q"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /d"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /V"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /L"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /u"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /Z"	rtxaeh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\21B.exe = "C:\\Program Files (x86)\\LP\\7D60\\21B.exe"	bohost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /k"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /R"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /O"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /v"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /b"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /l"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /B"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /T"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /o"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /N"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /M"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /J"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /f"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /i"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /a"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /q"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /F"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /e"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /Y"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /I"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /z"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /h"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /j"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /U"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /K"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /c"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /r"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /S"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /g"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /p"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /m"	DV245F.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /t"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /y"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /x"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /s"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /G"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /D"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /W"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /A"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /H"	rtxaeh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\rtxaeh = "C:\\Users\\Admin\\rtxaeh.exe /P"	rtxaeh.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	aohost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	aohost.exe

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
2848	tasklist.exe
2404	tasklist.exe
2292	tasklist.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2492 set thread context of 376	2492	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	30
PID 2816 set thread context of 2624	2816	aohost.exe	38

UPX packed file 21 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/376-4-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/376-12-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/376-6-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/376-13-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/376-2-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/376-16-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/376-14-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/2624-68-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2624-67-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2624-65-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2624-61-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2624-57-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2624-55-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/376-78-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/944-102-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/980-104-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/2320-160-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/980-162-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/980-239-0x0000000000400000-0x0000000000452000-memory.dmp	upx
behavioral1/memory/376-275-0x0000000000400000-0x00000000004CF000-memory.dmp	upx
behavioral1/memory/980-277-0x0000000000400000-0x0000000000452000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LP\7D60\21B.exe	bohost.exe
File opened for modification	C:\Program Files (x86)\LP\7D60\3514.tmp	bohost.exe
File opened for modification	C:\Program Files (x86)\LP\7D60\21B.exe	bohost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rtxaeh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DV245F.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bohost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bohost.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "442849611"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e45ead85669ee647812726b053804f3300000000020000000000106600000001000020000000c2c87098806d191925687b444a0f2d5bff7709cb892a948efaa032c2022123da000000000e80000000020000200000003a0b571c75207dfac11363e686878beb58e9cea822d4c4fe62241ca85fd2e14f20000000c19181ace986210b65f1445134f7bb90940a0948e77cfdc7531f8a025cdc694d40000000423cfc3e3aa40746e16e22db664e0d561da92189c6fb9de6d92bbb9c22aec5a6f305bb46df93895957210982fef8d2b91f9810f275a79a271cb7e640df201861	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0301c2af464db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{538F8481-D0E7-11EF-AB2E-FEF21B3B37D6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e45ead85669ee647812726b053804f330000000002000000000010660000000100002000000050a77a4aff0c38b3d7d90ab352097252f1cd942d640c59cee20d7a5d8b6fe2c6000000000e800000000200002000000036d4f5d3c8293d06aae107cb72e70011ce6b2b649961741c78797fbd6bb74b7e90000000741bdf9da0c5368f290c95b49b29a33d21d53767505bae385207ad3efba1f15076945114c4d157e75bb3ffc534aaaa10e887c9ba85fd9c2efeb83b0fac613d7e50cfbd5c4f2113db77ae582c7b18798b75c69875a5ea7d213fdcf6e435b732376768bbcd1dba2f40bcfccaa8231c7513614aac9d223a06fdf4e2f0c46e332e781468e770f604580886cc327c9067add9400000003a08939aebf4be745078f529618f7fbd1662bba2e6cd741854af8a939d1d0ee3e77b43c79364e0f704add545e0e35bdcd5d5b6b819bd3e62f3326f4cc3fd3b1e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1060	DV245F.exe
1060	DV245F.exe
2984	rtxaeh.exe
2624	aohost.exe
2984	rtxaeh.exe
980	bohost.exe
980	bohost.exe
980	bohost.exe
980	bohost.exe
980	bohost.exe
980	bohost.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
2984	rtxaeh.exe
980	bohost.exe
980	bohost.exe
980	bohost.exe
980	bohost.exe
980	bohost.exe
980	bohost.exe
980	bohost.exe
980	bohost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2144	explorer.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2848	tasklist.exe
Token: SeRestorePrivilege	2876	msiexec.exe
Token: SeTakeOwnershipPrivilege	2876	msiexec.exe
Token: SeSecurityPrivilege	2876	msiexec.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeDebugPrivilege	2404	tasklist.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeDebugPrivilege	2292	tasklist.exe
Token: SeShutdownPrivilege	2144	explorer.exe
Token: SeShutdownPrivilege	2144	explorer.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2460	iexplore.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe
2144	explorer.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
1060	DV245F.exe
2984	rtxaeh.exe
784	dohost.exe
2460	iexplore.exe
2460	iexplore.exe
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE
1528	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 376	2492	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	30
PID 2492 wrote to memory of 376	2492	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	30
PID 2492 wrote to memory of 376	2492	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	30
PID 2492 wrote to memory of 376	2492	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	30
PID 2492 wrote to memory of 376	2492	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	30
PID 2492 wrote to memory of 376	2492	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	30
PID 2492 wrote to memory of 376	2492	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	30
PID 2492 wrote to memory of 376	2492	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	30
PID 376 wrote to memory of 1060	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	31
PID 376 wrote to memory of 1060	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	31
PID 376 wrote to memory of 1060	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	31
PID 376 wrote to memory of 1060	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	31
PID 1060 wrote to memory of 2984	1060	DV245F.exe	32
PID 1060 wrote to memory of 2984	1060	DV245F.exe	32
PID 1060 wrote to memory of 2984	1060	DV245F.exe	32
PID 1060 wrote to memory of 2984	1060	DV245F.exe	32
PID 1060 wrote to memory of 2296	1060	DV245F.exe	33
PID 1060 wrote to memory of 2296	1060	DV245F.exe	33
PID 1060 wrote to memory of 2296	1060	DV245F.exe	33
PID 1060 wrote to memory of 2296	1060	DV245F.exe	33
PID 2296 wrote to memory of 2848	2296	cmd.exe	35
PID 2296 wrote to memory of 2848	2296	cmd.exe	35
PID 2296 wrote to memory of 2848	2296	cmd.exe	35
PID 2296 wrote to memory of 2848	2296	cmd.exe	35
PID 376 wrote to memory of 2816	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	37
PID 376 wrote to memory of 2816	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	37
PID 376 wrote to memory of 2816	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	37
PID 376 wrote to memory of 2816	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	37
PID 2816 wrote to memory of 2624	2816	aohost.exe	38
PID 2816 wrote to memory of 2624	2816	aohost.exe	38
PID 2816 wrote to memory of 2624	2816	aohost.exe	38
PID 2816 wrote to memory of 2624	2816	aohost.exe	38
PID 2816 wrote to memory of 2624	2816	aohost.exe	38
PID 2816 wrote to memory of 2624	2816	aohost.exe	38
PID 2816 wrote to memory of 2624	2816	aohost.exe	38
PID 2816 wrote to memory of 2624	2816	aohost.exe	38
PID 376 wrote to memory of 980	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	39
PID 376 wrote to memory of 980	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	39
PID 376 wrote to memory of 980	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	39
PID 376 wrote to memory of 980	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	39
PID 376 wrote to memory of 784	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	41
PID 376 wrote to memory of 784	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	41
PID 376 wrote to memory of 784	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	41
PID 376 wrote to memory of 784	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	41
PID 980 wrote to memory of 944	980	bohost.exe	42
PID 980 wrote to memory of 944	980	bohost.exe	42
PID 980 wrote to memory of 944	980	bohost.exe	42
PID 980 wrote to memory of 944	980	bohost.exe	42
PID 980 wrote to memory of 2320	980	bohost.exe	45
PID 980 wrote to memory of 2320	980	bohost.exe	45
PID 980 wrote to memory of 2320	980	bohost.exe	45
PID 980 wrote to memory of 2320	980	bohost.exe	45
PID 376 wrote to memory of 2200	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	48
PID 376 wrote to memory of 2200	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	48
PID 376 wrote to memory of 2200	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	48
PID 376 wrote to memory of 2200	376	JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe	48
PID 2200 wrote to memory of 2404	2200	cmd.exe	50
PID 2200 wrote to memory of 2404	2200	cmd.exe	50
PID 2200 wrote to memory of 2404	2200	cmd.exe	50
PID 2200 wrote to memory of 2404	2200	cmd.exe	50
PID 980 wrote to memory of 2068	980	bohost.exe	51
PID 980 wrote to memory of 2068	980	bohost.exe	51
PID 980 wrote to memory of 2068	980	bohost.exe	51
PID 980 wrote to memory of 2068	980	bohost.exe	51

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	bohost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	bohost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe cmd /c %SIGILL% "SIGTERM|DELETE|SIGKILL"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
  JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:376
- - C:\Users\Admin\DV245F.exe
    C:\Users\Admin\DV245F.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1060
  - - C:\Users\Admin\rtxaeh.exe
      "C:\Users\Admin\rtxaeh.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2984
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del DV245F.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2296
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2848
- - C:\Users\Admin\aohost.exe
    C:\Users\Admin\aohost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Users\Admin\aohost.exe
      aohost.exe
      4⤵
      Executes dropped EXE
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      PID:2624
- - C:\Users\Admin\bohost.exe
    C:\Users\Admin\bohost.exe
    3⤵
    - Modifies security service
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:980
  - - C:\Users\Admin\bohost.exe
      C:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\06669\3B37D.exe%C:\Users\Admin\AppData\Roaming\06669
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:944
  - - C:\Users\Admin\bohost.exe
      C:\Users\Admin\bohost.exe startC:\Program Files (x86)\6944B\lvvm.exe%C:\Program Files (x86)\6944B
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2320
  - - C:\Users\Admin\bohost.exe
      C:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\06669\3B37D.exe%C:\Users\Admin\AppData\Roaming\06669
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2068
  - - C:\Users\Admin\bohost.exe
      C:\Users\Admin\bohost.exe startC:\Program Files (x86)\6944B\lvvm.exe%C:\Program Files (x86)\6944B
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2612
  - - C:\Users\Admin\bohost.exe
      C:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\06669\3B37D.exe%C:\Users\Admin\AppData\Roaming\06669
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:764
  - - C:\Users\Admin\bohost.exe
      C:\Users\Admin\bohost.exe startC:\Program Files (x86)\6944B\lvvm.exe%C:\Program Files (x86)\6944B
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1904
  - - C:\Users\Admin\bohost.exe
      C:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\06669\3B37D.exe%C:\Users\Admin\AppData\Roaming\06669
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2436
  - - C:\Users\Admin\bohost.exe
      C:\Users\Admin\bohost.exe startC:\Program Files (x86)\6944B\lvvm.exe%C:\Program Files (x86)\6944B
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2080
  - - C:\Users\Admin\bohost.exe
      C:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\06669\3B37D.exe%C:\Users\Admin\AppData\Roaming\06669
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:892
  - - C:\Users\Admin\bohost.exe
      C:\Users\Admin\bohost.exe startC:\Program Files (x86)\6944B\lvvm.exe%C:\Program Files (x86)\6944B
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2344
  - - C:\Users\Admin\bohost.exe
      C:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\06669\3B37D.exe%C:\Users\Admin\AppData\Roaming\06669
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2152
  - - C:\Users\Admin\bohost.exe
      C:\Users\Admin\bohost.exe startC:\Program Files (x86)\6944B\lvvm.exe%C:\Program Files (x86)\6944B
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2676
- - C:\Users\Admin\dohost.exe
    C:\Users\Admin\dohost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:784
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://ginomp3.net
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2460
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1528
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del dohost.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2736
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_0c9051fa83195d90120b21f47b895221.exe
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2404

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2876

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b6b233e6c4a3eb11750f939d6e00f2ff

SHA1
a00ac0350d30bfb4406e1f4dce25a7a0f38b6c19

SHA256
343e520db4520fe4b1b4ba8e2fb07a91fb26ad174a3a4300cdba52b878eaaf9b

SHA512
1b4999f032da92b354f39b891a6b9260058729a2478b4ed57cee593f2cc939d6336f493be19f71ac2428492331fb23dceba1a331784b0b428b832ba73da77cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83c28548f6379155484acc918d7715b8

SHA1
ac724059bacf75ddd4c83a50facfbc81a283543e

SHA256
bb4b3018516ebe119c2aee50b4597cf2f8f6fdf7f95c4af2950f0bf9cd2ea55f

SHA512
ae9d62112aa4b0e5c001e3a12ad20f634287b6356a66f30e928ebed339e7af5ecee9e0e0b58f424d396d2994c42a1d6d838a60e041b2594b3dcb7bc2e2411d92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ccb7bdec94fd03e6b7983f67ebd225d

SHA1
d9c48ffc33f48845b7bf5277e149a447b42a13bc

SHA256
73d51beb79769427dd2e62dc1fb14d9a2662b6c1afdf7684a811a86dace9b3fc

SHA512
38200d50d19620d6f296d6ce40d17f48a2140a85cbbb90116d9508891a7a71fdc7363aa9fceb76b340607991ca429366990d7251a599de4cc14fa9cd35d4d5b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
301ec87625039a9859109af4f8e27c0b

SHA1
3251fc79dcab5c64602bb33312eba797257cee33

SHA256
b2eae828662995277debd5460152eb303c2255c3bcb9aa14e7ea4acf9da09543

SHA512
8b5a00e89926b2a517b563f4292e1c6123ff1bf6d5ecd6f2a4dc69706feecc51de2d8ba09de74e63c75c128ef9f2da78702dc942ac107c034c3d8ae6f4fa3849

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01b8c6663b18a925f81738dbcae9ea26

SHA1
a459dd474073fe4b71f80897a4fa6493a4b93849

SHA256
b76e77fd770c2a5ca1cb23e643887fb0da89ef2fb760316eacae5273c09bbfa0

SHA512
0e3ca60aa3ff2ff208bae2df3a5b606791dab91a0490133996d7dce7e57d4c68a97c9b81e38421e911b4665b499483be2651e3c202e9256f25d5519d40c00b75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58dabadcd47769ed75e8451c127330b0

SHA1
95768179199bf673900da988e116e5a5a5e267a5

SHA256
47c0ea095f88cf2dc039f11d0cb27056e276342f3ff0358649478e0dfdf6f354

SHA512
28e142e139367cfdf42f122d48730ac2daea43277a820c6bb4c8e2cffc5635650a1a12b5972c51bac4411bc6ddc9137f1a6268521b1d57baae87342ce8561e04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5b1a4cb561e4da130102c2073ea16f3

SHA1
e881c71ee3d5ee2870944724877499f67d6d07e7

SHA256
89f91bca9848828931e0ea64aa5483507764dc982d48138c2d47af8a6ef1f735

SHA512
3af58b3433d44536e6c7945591068cb6d1b616608072c04280760eaaa65aedd153a0c5b3f42425af799b6696d2cf52df32af6ef149f3afdfdbfdb62b1661f95c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53628948351f6b26509a664cb8b4e76c

SHA1
dc51fef225f032ea7da59c326e385b21d354d6f9

SHA256
4817600391c3c3a8662981a4c830d15ece3cf907d4e331ed704347a74a79f16f

SHA512
b95114533d23d30c6e61f4245c7a4cff7b80841cb92add63baa52eca5297d6490ec1060a5c8e33bdc4d632f421d7f4fd97cccb9d22f0ae98d7eff22cfd59dda1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3f1b8b4b15d522d3053f4e69ebbf6e9

SHA1
ece1f8bc86667d13aec3355c79c0d7baf7264933

SHA256
02e41914c3b9122959258ce4629d04e10289586bff114c7c13a2b54f49f58548

SHA512
1ef5d99d22ff757b5778fe3a1d6ce5778d0a2b2b9367f4fe3df10fadb0194eebdc5c16a8407961f6d537ff13ec788cfd9985559379b46cc8fdd25ce84fd78d7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63dab6e09dfc51f5efb9a56c831afddf

SHA1
1b10abfe041bbf5adae666e2d7c86d88d2933540

SHA256
ce7b2a8d09eb4765be335f91f1a29161efe266a1083faa1c8737e71c006c2642

SHA512
a383a1972fb45799809a908c2a213abd642e79cdfbd333971486b75daa32b06f76d004396e2ffacc323476472c4f8304d79cb562763d98ce8051774b2b45ab1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99e0e7fdd8e2fdc784fa56fed11c6705

SHA1
2c9ece9fc25da38e563397dd3509566ee458147f

SHA256
7c99cea4bfca8dee122cdc76df01e3d83c6070c9c0bb6969cb53890158d15288

SHA512
5e311206df4de795f560059d5d46622dddad11b0b091b1f821eebee29e7d765174c50c2bdca42bd97c533236af51dd304491811f77bcf51b14f0845bbab81fbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5206288262e3e4d6d36be12e46ac971a

SHA1
a84596486d90e91079346a7c27d6c08af8bd8ebb

SHA256
3ddc05e60b52029631d24d28f8eb92f27004d5e4cfc53ea68cf8c1ae89d1c743

SHA512
f5add1ee18c1d041b136dc4a2e04ab33e8d6ecd0720db245d46cca5e4f1e58d09a7a9888fc32c778790cf89f737422964705103f24a8c76fd7d3264d9aeb6d1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
630fdbdd0f949dd10555986b8870ac64

SHA1
92601e7507c1f265767e96d8c2e2b3615fd2211d

SHA256
80fdaeaafc4e5f4fb48271d88c35e85773f26b24ceeefdb8d9b45ed817b47668

SHA512
ff7c42e2a2e4f8fac2c56e7038d4d9e09fbf9135af6f97ea81ada568f6d66dfc87f4387d18b3882a936f2474238233ba855db414e46189c761de588b212f88f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6557b564364c2ca2ab96030c17462c0

SHA1
4a44aeb389ff619b3321ee411dca25fae4dc6c35

SHA256
da8f01bfa76c2cf4eefb5e410fee773af00a91c13a686de57953d528cbc1d2db

SHA512
5c42f59265a72aea60bfffa58c63c79e3d4e6a05b679ec3457ac167e4629957eb3e3c893d259db740a747e8c376e12a0428fb0262167bee0ca28d1271c65cea6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e832d9b344ac09f9e72c3b14cd06c07

SHA1
5729a7d26aa4acc476a902ddf30953c1b34dce96

SHA256
f3a08a280f40ade763670ecf856622ef76122b2ab678d348a667bd3d82a64022

SHA512
df6cc33c65da018ffdb4bbe70d5f348c20e188f11731ece78e5e669c25ad01de339aa33a7f57303e78827e65421061233d39580a90247934c6aa5b5fa753fa24

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00c0ac6095da79458273447441a8b362

SHA1
e5fdc80a2ff8345c38a0189a1c90cb3288e758ab

SHA256
cc781910f373ba977890d8288710ef4f31cff408f8026bc94cc922901876bfed

SHA512
aaf30c96a86ceddc836a79654546f46391f19c1dbe685e4ce3760897cb33ba2ea15fba798f9e4cf36f28880ee0a09329ce639914e90d473110844666b2470b00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc92eff2c4b52d5fc82bffdb5cafe1fa

SHA1
2b451000bde8be6d4b8b8231a5cde7729d5b9e09

SHA256
cba5d1778a733943b350dbbd97f9a400bfcf79f5a4f572c7713c905b51193119

SHA512
f5dc49428990cda345148fae6b35acc6de84ef109b22a614fc873119abf95539ca828536c96742f53abfaf036f05c17fb2097c55a6605e7e0eadb1a42d86058b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e101b852b5efb4f027abfb4dbf0bae7

SHA1
02cc63cfa74af23af843ab3c8b553bf8ca824ea8

SHA256
baaec18d14bb1e302622b04883fe0f5f1c921d6b8bdabeae4c702cdec69446b4

SHA512
35120509cfdd17bf9ab44617d2b943a91e80b0f05920c54dc7ad03a605452502f43af0661a38a5f3e7a6bb8cb24fafea45cc1eeee822deeb70b41dcd0c81b964

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
206bf21cb2b310f2174feda3cbfc222c

SHA1
85ae1044dd1ff2f2669ebccc83b156fb65f99aec

SHA256
dd5385ac0b33404b29ec9c96103c2ecd968a546cfe7114bc9a7e7367fc6218f0

SHA512
bd05a26fedbc37f6c9851618267d656e7173fa3af4987ecb8fa16ae494fdd2774a23e588352ed93301c9170c93b33ceb41c49588dae6810e86ceb78d12b6a987

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9218c95dd237102b7f41e5131506e07a

SHA1
8a87304d89783be87510f3a5baa124744f255a02

SHA256
5079322837a876369f14597b63f09c1358a54acc00e9583ac7530b79fe116915

SHA512
cdb29c097114b3aa2f8ea66ef4d3643d2a4fe470505867769ab51a48ea08147648963438231655282bedbb6af7effd021695dd4f3382475f89783896b26debc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
131c3db8d9baef80a641de68591e9fff

SHA1
a9d574012664806642f0f81b7976464910bcea86

SHA256
36a4b432d8407792f0315578455fec2913aac02a91f351bef21713d6ef58c2a6

SHA512
7320b393addeb48a7eae02f87141c8a9eb3acec6627e405d5c099e02856640fce8b2ae2e52680f74daaa9d2b116831e2678940e849c6a60ab1bbd764641f48e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0238a4a5bb4b4831a00f46e8d7a42f1f

SHA1
038515b945efb26cdd6da77ebbb1f97d274b33f6

SHA256
b0d4778d737a47653ce1c644bae792afb99ff0a9869fd31530564f5ede328b99

SHA512
534c4f73ce912a2379f7f7e0c57a262a756342836547ee521a9cdfcf2689bc9a95f643264a43a098095e73706dce58ab0796fea5cbc39c4be100cde542620f4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab600D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8068.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Roaming\06669\944B.666

Filesize
2KB

MD5
124c566a28938279d6617b98e6927467

SHA1
212b8bc3ce968ae2d02ebf2f05b8a00a295d5ef1

SHA256
2a5093db337e40ca0ad6245acd4ae27130034143551efeda1ca9669e7fc38430

SHA512
15e62111fc87b6743d02e52dedf7511651864a8675e4dc7eb00d3aefea5ff39b6101edbec4b0d991e1b26ec299574066a30245fb4848368c9cc41cd7be56d84a

Download Submit
C:\Users\Admin\AppData\Roaming\06669\944B.666

Filesize
600B

MD5
84f0f1c7aa3fe10f4105aaa8fab445e9

SHA1
89cef97f18d6bcf8bbf4a1208f115c15fa810e5b

SHA256
aa920e02481ae997d23ce5bce303752dc1cf73aeff3ade4158b24f3df463cceb

SHA512
08da8e0aa3d065ee1464f5e75528ecae86b1b83609808e8f827d4cc8b49bdda40bbc5fd77b3962a29f724bfd218e1323a5311e36dc7f0ac6789ba0df453f45b3

Download Submit
C:\Users\Admin\AppData\Roaming\06669\944B.666

Filesize
996B

MD5
5836f3b2919850cf040364685858fc91

SHA1
2f505fc43238c7ce852def5b4ae9ee5e42c8737d

SHA256
c3796fc4ddf35fdf9a375b3102f17c05970fa638c3d214161fb47af6c61f2c19

SHA512
c3dce2abe65ae18103d3eebd88b21aa4622309cf6977f16c96a642cb2df55af4d57c825b7ca77ec012449d91e1f661989bd2c1f369f48031a7cae43063ec9ec3

Download Submit
C:\Users\Admin\AppData\Roaming\06669\944B.666

Filesize
1KB

MD5
6f8c33a1a5590bb25a692086bd2a76e3

SHA1
9e1758818c8560946a7598cde8565fae0decba3a

SHA256
b2365716802cdc42bb74b3bab2d91de21c095ebb311c72a04520c509c2c9b2a2

SHA512
1fa7a650193d1a7fda2c54b0063107a8c8a0de19988c56656894faac0792751d6b859c349bdd410114a3d3eb11d4756e23448f196cc383529b0ed55cd6932be4

Download Submit
C:\Users\Admin\AppData\Roaming\06669\944B.666

Filesize
1KB

MD5
b1c895877ae68d6df52511656a5dc4bc

SHA1
e898909a52530ba4adac260277f846d5d051d46d

SHA256
33093301331df4330cbcdfabf2aa2ebe5094a07784bdb839e2f63900ceb045ff

SHA512
304f0086d4b9862fc1bd4b8b75eed346fa0c7baa2d5c376acc26c5a2ddff105b2822ae8e0139b4acb1b545f9ee2e445d4fa46137b5c0ec922287c4020d271d90

Download Submit
C:\Users\Admin\AppData\Roaming\06669\944B.666

Filesize
1KB

MD5
40abb12ed7a2c200d3a0bce7e4c8d0a7

SHA1
87a98b7184696be3c89734626d33bb41e96c062e

SHA256
f1b2345b808f6d4e3a84c97767ff0623d381ac30cff30eb22d0cfc7fd33d4d2c

SHA512
23b4563a142223b6e3f49def65aa4ba84b1ea04bdcabcbc487c484f63c254f9fb0108b008fd7da08dbb7d2e8ed8da1ccee37c147dbd132d9c017c21a5bee4696

Download Submit
C:\Users\Admin\AppData\Roaming\06669\944B.666

Filesize
2KB

MD5
8d55ff60b548e20cbea3df8d2dc71011

SHA1
661a8f22f8394150e32ec19e234ec30902e1854f

SHA256
83911318ab91755b16c25f4e1767705b9fcb0026d25cba069ce4dee14419f48f

SHA512
7f13dd0a99d45950408e00ddc9b7242e2288c023192ef9ff3e545e6b68644d921d573dfa096f347fd1db2df76fae35ca99cd625b95f90c37a16ed555db2e4cf6

Download Submit
\Users\Admin\DV245F.exe

Filesize
216KB

MD5
00b1af88e176b5fdb1b82a38cfdce35b

SHA1
c0f77262df92698911e0ac2f7774e93fc6b06280

SHA256
50f026d57fea9c00d49629484442ea59cccc0053d7db73168d68544a3bbf6f59

SHA512
9e55e7c440af901f9c6d0cdae619f6e964b9b75c9351c76ea64362ff161c150b12a1caabb3d2eb63353a59ae70e7159ca6b3793ed0cc11994766846ac316107f

Download Submit
\Users\Admin\aohost.exe

Filesize
152KB

MD5
4401958b004eb197d4f0c0aaccee9a18

SHA1
50e600f7c5c918145c5a270b472b114faa72a971

SHA256
4c477ed134bc76fa7b912f1aad5e59d4f56f993baa16646e25fec2fdeed3bd8b

SHA512
f0548bdaafce2cde2f9d3bd1c26ed3c8e9321ef6d706bd372e18886d834828e5bb54ae44f19764e94574ceb4a1a2a99bdd8476e174b05114fcac9a6d4a2d58e6

Download Submit
\Users\Admin\bohost.exe

Filesize
173KB

MD5
0578a41258df62b7b4320ceaafedde53

SHA1
50e7c0b00f8f1e5355423893f10ae8ee844d70f4

SHA256
18941e3030ef70437a5330e4689ec262f887f6f6f1da1cd66c0cbae2a76e75bf

SHA512
5870a73798bad1f92b4d79f20bf618112ec8917574f6b25ab968c47afff419a829eef57b0282fb4c53e6e636436c8cf52a01426c46bdd4a0ea948d371f0feb09

Download Submit
\Users\Admin\dohost.exe

Filesize
24KB

MD5
d7390e209a42ea46d9cbfc5177b8324e

SHA1
eff57330de49be19d2514dd08e614afc97b061d2

SHA256
d2d49c37bdf2313756897245c3050494b39e824af448450eca1c0e83cf95b1e5

SHA512
de0eb11dd20cd9d74f47b138fb4189a299a57173fe2635150045b01629354f35b26e0575acd25501403af0db238a123b2e5a79582b47aee1d6e786f5eec1929d

Download Submit
\Users\Admin\rtxaeh.exe

Filesize
216KB

MD5
4ad951b20cd67003e702b93ed6f2bf56

SHA1
df728d7e3acd7d4591f43f8d1cb7eb932402b81d

SHA256
6fef16cc140c098f08a67f7ec49e843a93caaa7e8a63a934e1341b4df43b78c5

SHA512
1e23ceb6cd0d8c944c0120834bc81099e07dfd517f718d51f85350cc66ad42c9c856a3dd1d135f5a374ba788133de9b57be4062c9fc5226561f0f3be770c6941

Download Submit
memory/376-272-0x00000000029E0000-0x000000000349A000-memory.dmp

Filesize
10.7MB

Download
memory/376-14-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/376-275-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/376-4-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/376-12-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/376-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/376-6-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/376-13-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/376-78-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/376-2-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/376-0-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/376-16-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/944-102-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/980-104-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/980-277-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/980-239-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/980-162-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2320-160-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2492-10-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2624-68-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2624-55-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2624-53-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2624-57-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2624-61-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2624-67-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2624-65-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2816-64-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download