cycbot | 77305518a1b2d8a76f3adaf7959dc850b5ed90ded43792ad26fb23d725505abd

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
27-01-2025 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
Size

841KB
MD5

42295816978b4c1162f604b8cc98e211
SHA1

c63183321b3ef906b62569d901b6fc61530b42c2
SHA256

77305518a1b2d8a76f3adaf7959dc850b5ed90ded43792ad26fb23d725505abd
SHA512

6c28c638883f72e672c1796d243a77b80ff1be1d392b58fb236f8351ed002101f7066064d00ec6c127781e835eadad133cd4b11a0032df227ce5d7ee9aabb91f
SSDEEP

24576:Y1ckXnJDH7oH1haz/5qgxuLh62tLqazx5QwLzyUSSykQ59aIkPTr:Y1v3Jz8H1hU/5qgQ62Bqad5g0yksxkrr

Score

10^/10

cycbot modiloader pony backdoor credential_access defense_evasion discovery persistence rat spyware stealer trojan upx

Malware Config

Signatures

Cycbot
Cycbot is a backdoor and trojan written in C++..
backdoor rat cycbot
Cycbot family
cycbot

Detects Cycbot payload 3 IoCs

Cycbot is a backdoor and trojan written in C++.

resource	yara_rule
behavioral1/memory/1088-150-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2360-151-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot
behavioral1/memory/2360-226-0x0000000000400000-0x000000000046A000-memory.dmp	family_cycbot

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

Modifies security service 2 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3"	clhost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	miGRu6Gcu2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	qucih.exe

Modiloader family
modiloader
Pony family
pony
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

ModiLoader Second Stage 9 IoCs

resource	yara_rule
behavioral1/memory/3068-9-0x0000000000400000-0x0000000000419000-memory.dmp	modiloader_stage2
behavioral1/memory/1736-14-0x0000000000400000-0x000000000051D000-memory.dmp	modiloader_stage2
behavioral1/memory/1736-13-0x0000000000400000-0x000000000051D000-memory.dmp	modiloader_stage2
behavioral1/files/0x00080000000174b4-50.dat	modiloader_stage2
behavioral1/memory/2604-67-0x0000000000400000-0x0000000000418000-memory.dmp	modiloader_stage2
behavioral1/files/0x0007000000017570-71.dat	modiloader_stage2
behavioral1/memory/2308-89-0x0000000000400000-0x0000000000418000-memory.dmp	modiloader_stage2
behavioral1/memory/1736-102-0x0000000000400000-0x000000000051D000-memory.dmp	modiloader_stage2
behavioral1/memory/1736-377-0x0000000000400000-0x000000000051D000-memory.dmp	modiloader_stage2

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Disables taskbar notifications via registry modification
defense_evasion

Deletes itself 1 IoCs

pid	Process
2140	cmd.exe

Executes dropped EXE 13 IoCs

pid	Process
1732	miGRu6Gcu2.exe
2836	qucih.exe
2604	alhost.exe
2608	alhost.exe
2308	blhost.exe
2020	blhost.exe
2360	clhost.exe
2920	dlhost.exe
1088	clhost.exe
2620	clhost.exe
336	csrss.exe
1144	elhost.exe
1840	41F0.tmp

Loads dropped DLL 17 IoCs

pid	Process
1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
1732	miGRu6Gcu2.exe
1732	miGRu6Gcu2.exe
1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
2360	clhost.exe
2360	clhost.exe
1840	41F0.tmp

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /Z"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /d"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /p"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /n"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /Q"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /h"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /g"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /V"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /M"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /x"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /K"	qucih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BF8.exe = "C:\\Program Files (x86)\\LP\\43C7\\BF8.exe"	clhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /C"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /O"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /A"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /U"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /m"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /s"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /H"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /k"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /a"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /j"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /G"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /S"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /o"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /b"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /r"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /y"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /R"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /Y"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /E"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /D"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /e"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /f"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /c"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /z"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /l"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /t"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /F"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /q"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /v"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /W"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /J"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /X"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /P"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /i"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /I"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /T"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /H"	miGRu6Gcu2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /B"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /N"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /L"	qucih.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\qucih = "C:\\Users\\Admin\\qucih.exe /u"	qucih.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	alhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	blhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	blhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	alhost.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
2408	tasklist.exe
832	tasklist.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3068 set thread context of 1736	3068	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	30
PID 2604 set thread context of 2608	2604	alhost.exe	38
PID 2308 set thread context of 2020	2308	blhost.exe	40
PID 2920 set thread context of 1080	2920	dlhost.exe	50

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1736-5-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/1736-3-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/1736-2-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/1736-14-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/1736-13-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/1736-12-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/2020-94-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2020-93-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2020-92-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2020-87-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2020-83-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2020-81-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/1736-102-0x0000000000400000-0x000000000051D000-memory.dmp	upx
behavioral1/memory/1088-150-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2360-151-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/2360-226-0x0000000000400000-0x000000000046A000-memory.dmp	upx
behavioral1/memory/1736-377-0x0000000000400000-0x000000000051D000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\LP\43C7\BF8.exe	clhost.exe
File opened for modification	C:\Program Files (x86)\LP\43C7\BF8.exe	clhost.exe
File opened for modification	C:\Program Files (x86)\LP\43C7\41F0.tmp	clhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qucih.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	elhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41F0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	miGRu6Gcu2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	blhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	clhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	clhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dlhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	clhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1732	miGRu6Gcu2.exe
1732	miGRu6Gcu2.exe
2608	alhost.exe
2608	alhost.exe
2608	alhost.exe
2836	qucih.exe
2836	qucih.exe
2020	blhost.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2608	alhost.exe
2608	alhost.exe
2360	clhost.exe
2360	clhost.exe
2360	clhost.exe
2360	clhost.exe
2360	clhost.exe
2360	clhost.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2608	alhost.exe
2608	alhost.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2608	alhost.exe
2608	alhost.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2608	alhost.exe
2608	alhost.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2836	qucih.exe
2608	alhost.exe
2836	qucih.exe
2608	alhost.exe
2360	clhost.exe
2360	clhost.exe
2360	clhost.exe
2360	clhost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2156	explorer.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	tasklist.exe
Token: SeRestorePrivilege	2152	msiexec.exe
Token: SeTakeOwnershipPrivilege	2152	msiexec.exe
Token: SeSecurityPrivilege	2152	msiexec.exe
Token: SeDebugPrivilege	2920	dlhost.exe
Token: SeShutdownPrivilege	2156	explorer.exe
Token: SeShutdownPrivilege	2156	explorer.exe
Token: SeShutdownPrivilege	2156	explorer.exe
Token: SeShutdownPrivilege	2156	explorer.exe
Token: SeShutdownPrivilege	2156	explorer.exe
Token: SeShutdownPrivilege	2156	explorer.exe
Token: SeShutdownPrivilege	2156	explorer.exe
Token: SeShutdownPrivilege	2156	explorer.exe
Token: SeShutdownPrivilege	2156	explorer.exe
Token: SeShutdownPrivilege	2156	explorer.exe
Token: SeDebugPrivilege	2920	dlhost.exe
Token: SeShutdownPrivilege	2156	explorer.exe
Token: SeShutdownPrivilege	2156	explorer.exe
Token: SeDebugPrivilege	832	tasklist.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe
2156	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
1732	miGRu6Gcu2.exe
2836	qucih.exe
1144	elhost.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1736	3068	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	30
PID 3068 wrote to memory of 1736	3068	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	30
PID 3068 wrote to memory of 1736	3068	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	30
PID 3068 wrote to memory of 1736	3068	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	30
PID 3068 wrote to memory of 1736	3068	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	30
PID 3068 wrote to memory of 1736	3068	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	30
PID 3068 wrote to memory of 1736	3068	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	30
PID 3068 wrote to memory of 1736	3068	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	30
PID 1736 wrote to memory of 1732	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	31
PID 1736 wrote to memory of 1732	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	31
PID 1736 wrote to memory of 1732	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	31
PID 1736 wrote to memory of 1732	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	31
PID 1732 wrote to memory of 2836	1732	miGRu6Gcu2.exe	32
PID 1732 wrote to memory of 2836	1732	miGRu6Gcu2.exe	32
PID 1732 wrote to memory of 2836	1732	miGRu6Gcu2.exe	32
PID 1732 wrote to memory of 2836	1732	miGRu6Gcu2.exe	32
PID 1732 wrote to memory of 2828	1732	miGRu6Gcu2.exe	33
PID 1732 wrote to memory of 2828	1732	miGRu6Gcu2.exe	33
PID 1732 wrote to memory of 2828	1732	miGRu6Gcu2.exe	33
PID 1732 wrote to memory of 2828	1732	miGRu6Gcu2.exe	33
PID 1736 wrote to memory of 2604	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	35
PID 1736 wrote to memory of 2604	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	35
PID 1736 wrote to memory of 2604	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	35
PID 1736 wrote to memory of 2604	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	35
PID 2828 wrote to memory of 2408	2828	cmd.exe	36
PID 2828 wrote to memory of 2408	2828	cmd.exe	36
PID 2828 wrote to memory of 2408	2828	cmd.exe	36
PID 2828 wrote to memory of 2408	2828	cmd.exe	36
PID 2604 wrote to memory of 2608	2604	alhost.exe	38
PID 2604 wrote to memory of 2608	2604	alhost.exe	38
PID 2604 wrote to memory of 2608	2604	alhost.exe	38
PID 2604 wrote to memory of 2608	2604	alhost.exe	38
PID 2604 wrote to memory of 2608	2604	alhost.exe	38
PID 2604 wrote to memory of 2608	2604	alhost.exe	38
PID 2604 wrote to memory of 2608	2604	alhost.exe	38
PID 2604 wrote to memory of 2608	2604	alhost.exe	38
PID 2604 wrote to memory of 2608	2604	alhost.exe	38
PID 2604 wrote to memory of 2608	2604	alhost.exe	38
PID 1736 wrote to memory of 2308	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	39
PID 1736 wrote to memory of 2308	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	39
PID 1736 wrote to memory of 2308	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	39
PID 1736 wrote to memory of 2308	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	39
PID 2308 wrote to memory of 2020	2308	blhost.exe	40
PID 2308 wrote to memory of 2020	2308	blhost.exe	40
PID 2308 wrote to memory of 2020	2308	blhost.exe	40
PID 2308 wrote to memory of 2020	2308	blhost.exe	40
PID 2308 wrote to memory of 2020	2308	blhost.exe	40
PID 2308 wrote to memory of 2020	2308	blhost.exe	40
PID 2308 wrote to memory of 2020	2308	blhost.exe	40
PID 2308 wrote to memory of 2020	2308	blhost.exe	40
PID 1736 wrote to memory of 2360	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	41
PID 1736 wrote to memory of 2360	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	41
PID 1736 wrote to memory of 2360	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	41
PID 1736 wrote to memory of 2360	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	41
PID 1736 wrote to memory of 2920	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	44
PID 1736 wrote to memory of 2920	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	44
PID 1736 wrote to memory of 2920	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	44
PID 1736 wrote to memory of 2920	1736	JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe	44
PID 2360 wrote to memory of 1088	2360	clhost.exe	45
PID 2360 wrote to memory of 1088	2360	clhost.exe	45
PID 2360 wrote to memory of 1088	2360	clhost.exe	45
PID 2360 wrote to memory of 1088	2360	clhost.exe	45
PID 2360 wrote to memory of 2620	2360	clhost.exe	47
PID 2360 wrote to memory of 2620	2360	clhost.exe	47

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	clhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	clhost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
PID:336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:844

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
  JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Users\Admin\miGRu6Gcu2.exe
    C:\Users\Admin\miGRu6Gcu2.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1732
  - - C:\Users\Admin\qucih.exe
      "C:\Users\Admin\qucih.exe"
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2836
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c tasklist&&del miGRu6Gcu2.exe
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2408
- - C:\Users\Admin\alhost.exe
    C:\Users\Admin\alhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2604
  - - C:\Users\Admin\alhost.exe
      alhost.exe
      4⤵
      Executes dropped EXE
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      PID:2608
- - C:\Users\Admin\blhost.exe
    C:\Users\Admin\blhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Users\Admin\blhost.exe
      blhost.exe
      4⤵
      Executes dropped EXE
      Maps connected drives based on registry
      Suspicious behavior: EnumeratesProcesses
      PID:2020
- - C:\Users\Admin\clhost.exe
    C:\Users\Admin\clhost.exe
    3⤵
    - Modifies security service
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    - System policy modification
    PID:2360
  - - C:\Users\Admin\clhost.exe
      C:\Users\Admin\clhost.exe startC:\Users\Admin\AppData\Roaming\7C0B3\3CD43.exe%C:\Users\Admin\AppData\Roaming\7C0B3
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1088
  - - C:\Users\Admin\clhost.exe
      C:\Users\Admin\clhost.exe startC:\Program Files (x86)\B3E25\lvvm.exe%C:\Program Files (x86)\B3E25
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2620
  - - C:\Program Files (x86)\LP\43C7\41F0.tmp
      "C:\Program Files (x86)\LP\43C7\41F0.tmp"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1840
- - C:\Users\Admin\dlhost.exe
    C:\Users\Admin\dlhost.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1080
- - C:\Users\Admin\elhost.exe
    C:\Users\Admin\elhost.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c tasklist&&del JaffaCakes118_42295816978b4c1162f604b8cc98e211.exe
    3⤵
    - Deletes itself
    - System Location Discovery: System Language Discovery
    PID:2140
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:832

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\7C0B3\3E25.C0B

Filesize
300B

MD5
38ec974621cc0c4184b08b4b1dda972c

SHA1
bc5c15d4162f4c2503ba10e5ad6d94619b9876c2

SHA256
827ab447cf20a2da1929c8a59dac2f263ff23df090f6d643f892a05f520c0998

SHA512
abe3ddbd5405935b02bcb024dc8918bf1321122aff0b80fe73fddc2f7cb7729159316d946534d3680951843be6a448b0304911b93d842148f76370f965a982f6

Download Submit
C:\Users\Admin\AppData\Roaming\7C0B3\3E25.C0B

Filesize
600B

MD5
ee899a070f0cb1e797b0b508a338412a

SHA1
1e0f7dbd5e149fd4013c1daf22a7131c408d0a5a

SHA256
02aac911ceac90713bd6cca2e2c0648f5f1d145f30e0ce671e88ea6bd7865035

SHA512
7c323f3b5f5dcfa6ae78a38a436fc855affafe925cc81d6f97f4750af3cd2618a8f3808d6558db4714fbfbde92d3db3b0371a97d28071e8ef7115ee45f93e346

Download Submit
C:\Users\Admin\AppData\Roaming\7C0B3\3E25.C0B

Filesize
996B

MD5
7d23a552840f48c2cb15a714d1b8b199

SHA1
ba198a4b7a610d83987b7dda43d045966340ecfe

SHA256
e06fd5f0dbd9ca13b3f17b88e15a366baa104181ef97f27a7296428fc4596fd8

SHA512
f2acedba56e2489f339eff52b43b04de19abdbe405de417c9166accb757f399261a271c4fd160a8726db70cf23beda7f7eb8d97198e516a55c574dd7957c4b93

Download Submit
C:\Users\Admin\AppData\Roaming\7C0B3\3E25.C0B

Filesize
1KB

MD5
2cc1c42d10722dc119bc5ce3a7dd6805

SHA1
d09216b3269b1a214ff1a0d0a5d5529ad09008c2

SHA256
f0bfcc7124610c34b9f8d0ea1dbb484d71c5542cc810fc03623642f3c602539e

SHA512
e687b88981551adb463b7b2a68a5cadf45d3535aff3afd2340d3d3033cfb667362d1a6e46e7acb9cf89954248545d8afe121d111ba8d3846393e2fc04aa2de87

Download Submit
C:\Users\Admin\alhost.exe

Filesize
236KB

MD5
ccee7bbbd52e9e3d551451e54f85489a

SHA1
7f72be25a00d4e667f17fa106bf024fac3eb9886

SHA256
24d5bac9c9a2d7e77dc8f79ad7fe3333283028dbec964effd9020dd6473e3290

SHA512
3e2fd0abfc61741698570a600aa4f845503410bc9bef9906dced2df27e5f38c7bb06eefb653a0e199eec88044725e2c0f0238253c73979fcceecb992e3b73af4

Download Submit
C:\Users\Admin\elhost.exe

Filesize
32KB

MD5
00a9df0a178efb6f4f44aa392186c492

SHA1
d3c3039ca41481525815bca5301d9d00f5725667

SHA256
c505d1c76b1e886de65c6b7b171a9d56870a320532c7561f7f8b162920602b18

SHA512
ae0cbce9119ec561a8084610a42f30f60ed29d6bde908dedb7394dbcd8cd24456c85a543b72aa797705130ccce851a348a5171baf1c8a2499ad599b345283a3f

Download Submit
C:\Users\Admin\miGRu6Gcu2.exe

Filesize
192KB

MD5
869d4fbc9194f74e9815f487d245fcff

SHA1
66ac3d8d447558f6389e3a8e203c1b60634af873

SHA256
b7bc5a05d5190e33bcf35bc06107881990caf3fd99643c50eb855ca8505d7113

SHA512
57700b710c9c42ed07f1959c7a17d592a5bfafadb340eaec33d769a788cb5b84de7d84b4ff5b865df9fedd966d7dc8b5a2534811e1de52f488a31a5548d4d6ce

Download Submit
C:\Users\Admin\qucih.exe

Filesize
192KB

MD5
c08e40062fa334f7ba0e1003f384a7a5

SHA1
82b232f3e981d8f83c0ea257461caefeb34222ca

SHA256
4ac4a1077ed9c841c7d72b692e36fee3dd4a5294d35d78afcefb557635d4455f

SHA512
d4bb3925f30f2c196b4bce2ee63551719123aa65e7a0100b492b3a5a026bbd6fd79e60df2c601e22105e3c3343f34993dd11ee879c85cbb8754905ce4379499f

Download Submit
C:\Windows\system32\consrv.dll

Filesize
53KB

MD5
63e99b675a1337db6d8430195ea3efd2

SHA1
1baead2bf8f433dc82f9b2c03fd65ce697a92155

SHA256
6616179477849205eb4075b75a042056d196f45d67f78929dbb3317a35ccbea9

SHA512
f5b986eafa38dbc9ad7759784ac887ecbb9c8d8009a3f33e91b9c9ceeaf043ed3e4ddab8e6b6b77e54aed9fcecab02442c8ff253f2136ea06996d05ddd68199f

Download Submit
\??\globalroot\systemroot\assembly\temp\@

Filesize
2KB

MD5
bb9d77852535842d67195d8d0bbffaa3

SHA1
3cc1270ae15abcc7578a961662f5d3636cc7df09

SHA256
77f487043fec23ec7cf7abeadde4e0136bee7cae550b6d8af48d51bdfa996142

SHA512
108bad14e0156712df99e98503287f5278b53cc70626322cb5de927872560daf496ab797057facb51ca324eb80c37eb995d17ba162fb340f624cb0b8aa204191

Download Submit
\Program Files (x86)\LP\43C7\41F0.tmp

Filesize
99KB

MD5
0f322aa9f0ab8f4d2ac9dc7c1f67789b

SHA1
bd0abad1aa3edd06bd176282c9ec3fa528ccf5f8

SHA256
b788fc4b83fc9e83f3dd7a14e25c251434f5a3389750e380ea32a93662525863

SHA512
736af7f378d4f05576010d4cd732ea02dd7e31999cd8e4ad7037686623a0a7a7a45e0376024327943e8a5ba9d090a1f4b2a6e7bc4366b05631abf371070cc6c9

Download Submit
\Users\Admin\blhost.exe

Filesize
126KB

MD5
f9482a349a998f5c9cb842705e67fea7

SHA1
196794ddf71cab834c7029dbf1c27009b06754b2

SHA256
9e5b1531710c57fad4e07c5888db6823e6634384a5ebe9d7f40b54cb9a163b44

SHA512
71ced1fbd460b833d1f422a80d5a27a893e18f7a6286cb61b1283a2c843f8fc77a68b30cba33fe988063f5db3893cb7fd8f677e023960b1999386c18389c9536

Download Submit
\Users\Admin\clhost.exe

Filesize
283KB

MD5
78b038f42b4e2490672f9a35a42674b5

SHA1
ca8972f311b9dab6aa917b65cfb9726447fb44f8

SHA256
99125e2bff877025e5687aa5928061cc7da65a944afcd81a66f556bf5d48730d

SHA512
13826dd7b9b1de6b08189c814487fcf6dd369059be8f70d5ba7ef6e9339a56be6f04a424e11238cc49a932e7d2988630c102109a861cb4adb5382f9e883ae515

Download Submit
\Users\Admin\dlhost.exe

Filesize
244KB

MD5
682907092bb50419e5b28cf99466e124

SHA1
622962a69e71cf4192f860be74249be205e9ce13

SHA256
9e08b47ad6498e8f7173eb8a9e2ce2c4aaa36d0c69cfb3365ba76938d037f98e

SHA512
cced9e3ec516c2e07182ecf012749b9b123bd70d6204d5f82afa4c0a8a8f110da8690c816e7c8d97f9a283e8e4961fbe0afa60badd4b57d21a8decfa1b527799

Download Submit
\Windows\assembly\GAC_32\Desktop.ini

Filesize
4KB

MD5
758f90d425814ea5a1d2694e44e7e295

SHA1
64d61731255ef2c3060868f92f6b81b4c9b5fe29

SHA256
896221147d8172197cbbf06c45d461141ce6b4af38027c1a22d57c1165026433

SHA512
11858e498309f611ee6241c026a402d6d979bffe28d4cbf7c9d5a89c3f3de25e1d253ab552ef7bc7cc43dd056307bd625e2e4f09beb21f0214c3946113b97ca9

Download Submit
memory/1088-150-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1732-43-0x0000000003770000-0x000000000422A000-memory.dmp

Filesize
10.7MB

Download
memory/1736-12-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1736-14-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1736-377-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1736-0-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1736-13-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1736-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1736-5-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1736-3-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1736-2-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1736-102-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2020-83-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2020-81-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2020-87-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2020-92-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2020-93-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2020-94-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2020-79-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2308-89-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2360-151-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2360-226-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/2604-67-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/2608-56-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2608-59-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2608-70-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2608-66-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2608-62-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2608-54-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2608-52-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2608-147-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/2920-227-0x0000000000390000-0x00000000003CD000-memory.dmp

Filesize
244KB

Download
memory/2920-159-0x0000000000390000-0x00000000003CD000-memory.dmp

Filesize
244KB

Download
memory/2920-153-0x0000000000390000-0x00000000003CD000-memory.dmp

Filesize
244KB

Download
memory/2920-156-0x0000000000390000-0x00000000003CD000-memory.dmp

Filesize
244KB

Download
memory/2920-161-0x0000000000390000-0x00000000003CD000-memory.dmp

Filesize
244KB

Download
memory/2920-160-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/3068-9-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download