neshta | 50da5c1c2f6d54077043ff6ac57cee5a10617b8855d62b591c64848024526f5f

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-02-2025 14:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
Size

1.1MB
MD5

a0a434abece1bdc69420b5fda0ea1a53
SHA1

3dc3876e19dab542f0d2b3a629965e6b2ed41dbb
SHA256

50da5c1c2f6d54077043ff6ac57cee5a10617b8855d62b591c64848024526f5f
SHA512

8c8fa0d42c9301894ae6fd90b2fca133db8cabeefde4c3493c762df2108ba37684b4f4c28f0fbae0442ad2b77be36396f738f13627079b138c4b1b80c60a8674
SSDEEP

24576:5ykiMICeww7nyoYi0HqF+WceO5REk6Fw/f9Y7bVRsd5FV9De:vF+Fqe23Ywy5kf9De

Score

10^/10

neshta discovery persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 3 IoCs

resource	yara_rule
behavioral1/files/0x0001000000010314-14.dat	family_neshta
behavioral1/memory/2816-194-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/2816-196-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Neshta family
neshta

Executes dropped EXE 2 IoCs

pid	Process
3060	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
1408	update.exe

Loads dropped DLL 7 IoCs

pid	Process
2816	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
2816	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
3060	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
1408	update.exe
1408	update.exe
1408	update.exe
2816	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\i:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\j:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\k:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\m:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\p:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\s:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\v:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\y:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\z:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\a:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\n:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\o:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\x:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\g:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\q:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\t:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\w:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\b:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\e:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\h:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\l:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\r:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened (read-only)	\??\u:	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSQRY32.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\Eula.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GO664E~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOHTMED.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2936	2816	WerFault.exe	29

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	update.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	update.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	1408	update.exe
Token: SeRestorePrivilege	1408	update.exe
Token: SeRestorePrivilege	1408	update.exe
Token: SeRestorePrivilege	1408	update.exe
Token: SeRestorePrivilege	1408	update.exe
Token: SeRestorePrivilege	1408	update.exe
Token: SeRestorePrivilege	1408	update.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 3060	2816	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	30
PID 2816 wrote to memory of 3060	2816	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	30
PID 2816 wrote to memory of 3060	2816	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	30
PID 2816 wrote to memory of 3060	2816	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	30
PID 3060 wrote to memory of 1408	3060	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	31
PID 3060 wrote to memory of 1408	3060	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	31
PID 3060 wrote to memory of 1408	3060	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	31
PID 3060 wrote to memory of 1408	3060	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	31
PID 3060 wrote to memory of 1408	3060	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	31
PID 3060 wrote to memory of 1408	3060	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	31
PID 3060 wrote to memory of 1408	3060	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	31
PID 2816 wrote to memory of 2936	2816	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	32
PID 2816 wrote to memory of 2936	2816	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	32
PID 2816 wrote to memory of 2936	2816	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	32
PID 2816 wrote to memory of 2936	2816	JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe	32

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe"
1⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3060
- - \??\c:\5f30183ce\update\update.exe
    c:\5f30183ce\update\update.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:1408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2816 -s 448
  2⤵
  - Program crash
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe

Filesize
547KB

MD5
d79d6c445af89ac11b0349afc5dcd74b

SHA1
b9f4828b300812402aa3fe9d30dd1358419989e9

SHA256
b5cea0ec1c56740e98fd97f9c5be552bcd878d8d5e4c489aa32372acf9c2e340

SHA512
7b777152c28252de2a85afb63f48b5660372af3ea53281cb8d5e478425a9a05f39baf2d5421456be5941d80d1c10b1d640ec2c728c971504f8332c362a190069

Download Submit
\5f30183ce\update\update.exe

Filesize
270KB

MD5
8a337ef84139089cb726e414412c7e3c

SHA1
f36f33b11fd384d656df355cf70c5b0852da79c4

SHA256
6b7bfad25078e1a53e3a3ae2b1824b40d9b27bc67d45fef606bbbebe9d359c87

SHA512
4a83ee8a1053ad2fd2bab7bbf02051910596fe74743b62a4a5c31aa87786e9a3c2577e4c9ae1880757d273abf1a8314e3ecd2f3a3a71cf34a7ad4e90d718c6c3

Download Submit
\??\c:\5f30183ce\update\update.inf

Filesize
6KB

MD5
8878656191bdc46374d9f914c1b8582b

SHA1
6b45cb7fb2e2040e5e8343318c0032b5acf597c1

SHA256
00262bd370da9bd72aa440f3c9e7f2e7ba33dcd08edb21909c7a80112a79b0bc

SHA512
fdc9c4210501bc993a31ac6b83b8a9d127376c6f8e3a529d8524a37c4e4ee3a391b17c558d5a08a75b67d2727e116c516be7b6c932be4c8c6e5552d7360d8448

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\JaffaCakes118_a0a434abece1bdc69420b5fda0ea1a53.exe

Filesize
1.1MB

MD5
0b757f6f12d8d95b2e4194d9f922a70e

SHA1
680ec904c6e256f04756736872d21980c5952af6

SHA256
2e4ddd73b74f7bcb24325a69cadba99f824acea342f222f718c8380e9e178850

SHA512
3cfc1d3e9caa8c3252796dcbbb0fa0618c1a086286bafc75882dbc6d3452ac4d4e5767d941b85c201cd07b30698c27f6c336ddb25eb28613d8534bee7bd75c58

Download Submit
memory/2816-194-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2816-196-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads