gh0strat | da8d2cc4377dc08214a3c890595d97664ef8af254bf7b9455df334acfaa5f505

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe
Size

203KB
MD5

8a6cce77a711d9d113f98a58b6aa48a5
SHA1

1fd42e056fa298ce1553fee307edc4b7cff5b680
SHA256

da8d2cc4377dc08214a3c890595d97664ef8af254bf7b9455df334acfaa5f505
SHA512

029c36819e379cc3a34c073e89481044087ed0fc0c97f917307b19aa4d24fa095cd800c4c3353b5ce61057a800917de8890ad5cc8c069210a9c91686adfc331f
SSDEEP

6144:Vo01LUBA4I1P4u75D9CMnvt5kxCbSTPujr+OY:VTUBeP7XvkxbSjr+N

Score

10^/10

gh0strat bootkit defense_evasion discovery persistence rat upx

Malware Config

Signatures

Gh0st RAT payload 5 IoCs

resource	yara_rule
behavioral1/files/0x0004000000003e98-75.dat	family_gh0strat
behavioral1/memory/1972-77-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral1/memory/1972-82-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral1/memory/1972-86-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat
behavioral1/memory/1972-197-0x0000000020000000-0x0000000020027000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe D:\\VolumeXX"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe D:\\VolumeXX"	mshta.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	mshta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	mshta.exe

Process spawned unexpected child process 6 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1720	2064	attrib.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2972	2064	attrib.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2604	2064	attrib.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2064	attrib.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2700	2064	attrib.exe	61
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3032	2064	attrib.exe	61

Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs

persistence

Terminal Services DLL

T1505.005

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ENHFSH7R\Parameters\ServiceDll = "C:\\Windows\\system32\\6oVUDN.dll"	ki19750.tmp

Sets file to hidden 1 TTPs 6 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2700	attrib.exe
3032	attrib.exe
1720	attrib.exe
2972	attrib.exe
2604	attrib.exe
2860	attrib.exe

Deletes itself 1 IoCs

pid	Process
2096	cmd.exe

Executes dropped EXE 6 IoCs

pid	Process
2704	inl92EF.tmp
2732	ki19750.tmp
2172	lie985B.tmp
2488	ki2AF84.tmp
2228	19920306.exe
372	920306.exe

Loads dropped DLL 14 IoCs

pid	Process
2460	cmd.exe
2460	cmd.exe
2756	cmd.exe
2756	cmd.exe
1972	svchost.exe
2776	cmd.exe
2776	cmd.exe
2516	cmd.exe
2516	cmd.exe
2488	ki2AF84.tmp
2488	ki2AF84.tmp
2488	ki2AF84.tmp
3004	rundll32.exe
2732	rundll32.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	D:\VolumeXX\desktop.ini	mshta.exe
File created	D:\VolumeXX\desktop.ini	mshta.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\oaglavtrmv	svchost.exe
File created	C:\Windows\SysWOW64\6oVUDN.dll	ki19750.tmp

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2776-108-0x0000000000100000-0x000000000010F000-memory.dmp	upx
behavioral1/memory/2172-121-0x0000000000400000-0x000000000040F000-memory.dmp	upx

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\19920306.exe	ki2AF84.tmp
File created	C:\Program Files\Common Files\920306.exe	ki2AF84.tmp
File created	C:\Program Files\temp01\XX.exe	ki2AF84.tmp
File opened for modification	C:\Program Files\temp01\XX.exe	ki2AF84.tmp
File opened for modification	C:\Program Files (x86)\TheWorld 3\TheWorld.ini	rundll32.exe
File opened for modification	C:\Program Files (x86)\TheWorld 3\TheWorld.ini	rundll32.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DPX\setupact.log	expand.exe
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	expand.exe
File created	C:\Windows\Win.ini	ki19750.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inl92EF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lie985B.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ki2AF84.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	920306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1012	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd45606a1f8cf646adc643e3857225a60000000002000000000010660000000100002000000017536fd5af8e81a4cb7145bdee43cbfa6220932e9babbd4ebb96ef645e9ff5c9000000000e8000000002000020000000bf83076a399ded60b777c58fdfb64b62435f652b7a7527dda61c2da2ebbe559a20000000849cd665cb9ed7f0adf96fc089f3faa1beca882ccd32ad98bb6e2e184264ac85400000000b29e780442edd2da1533ed7741a72c9b9a86f8bb176015db7997bc624f89f1f66da36a3bcdc77e7c0451a39f681a7e86cc21dc74bb4bacef91956f2a35f1359	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0c21e6dae9fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95CC8471-0BA1-11F0-A160-DA2FFA21DAE1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd45606a1f8cf646adc643e3857225a6000000000200000000001066000000010000200000009f64050ced4757e17721d56363cd7bee2eea3d49bd1afda35df5b8ed93b702c1000000000e800000000200002000000020acfbc71ac696301caba7b496980db1b587b53e01ec786881f209cf49f5a4619000000002b7d188e43c3f836bc406a532f9c60a23706963b46237f4c056cfb016331f99ca520a104ae074043fb3a20b1989ff5afdc8452e972bc01de7bd472615253ac3b66cb5ca86aa68a106de6eaa8fef47401680f5c042c5f1e3014ed0ba072a583b5c858c0b91e0795f72bf757bcf0e94c0c7e343be0f185c13e3a5a228c61e970464aed93d425fa935cb90cbf19455fbda4000000061d0cf42a74a9325050ed03904c3e84d791bb3dbee68c30450fa8016a5c4c348177d4152e8441ec889df57624c4660d49d3be7e405a65d8338da77d3cf362302	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "449306775"	iexplore.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum\Version = "7"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	svchost.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\IsShortCut	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)\command	mshta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"	mshta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\IsShortCut	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}	mshta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)\command\ = "mshta.exe C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\NTUSER~1.HTA"	mshta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)\command\ = "mshta.exe C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\NTUSER~1.HTA"	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)\command	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F92DA15-A229-A4D5-B5CE-5280C8B89C19}\shell\open(&H)	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	mshta.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"	mshta.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	mshta.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1012	PING.EXE

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2732	ki19750.tmp
2732	ki19750.tmp
2732	ki19750.tmp
2732	ki19750.tmp
2732	ki19750.tmp
2732	ki19750.tmp
1972	svchost.exe
1972	svchost.exe
2704	inl92EF.tmp
2488	ki2AF84.tmp

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2628	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe
Token: SeBackupPrivilege	2732	ki19750.tmp
Token: SeRestorePrivilege	2732	ki19750.tmp
Token: SeBackupPrivilege	1972	svchost.exe
Token: SeRestorePrivilege	1972	svchost.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2288	iexplore.exe
2288	iexplore.exe
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2460	2628	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe	30
PID 2628 wrote to memory of 2460	2628	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe	30
PID 2628 wrote to memory of 2460	2628	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe	30
PID 2628 wrote to memory of 2460	2628	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe	30
PID 2628 wrote to memory of 2200	2628	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe	31
PID 2628 wrote to memory of 2200	2628	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe	31
PID 2628 wrote to memory of 2200	2628	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe	31
PID 2628 wrote to memory of 2200	2628	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe	31
PID 2628 wrote to memory of 2096	2628	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe	34
PID 2628 wrote to memory of 2096	2628	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe	34
PID 2628 wrote to memory of 2096	2628	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe	34
PID 2628 wrote to memory of 2096	2628	JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe	34
PID 2200 wrote to memory of 3068	2200	cmd.exe	36
PID 2200 wrote to memory of 3068	2200	cmd.exe	36
PID 2200 wrote to memory of 3068	2200	cmd.exe	36
PID 2200 wrote to memory of 3068	2200	cmd.exe	36
PID 2460 wrote to memory of 2704	2460	cmd.exe	37
PID 2460 wrote to memory of 2704	2460	cmd.exe	37
PID 2460 wrote to memory of 2704	2460	cmd.exe	37
PID 2460 wrote to memory of 2704	2460	cmd.exe	37
PID 2704 wrote to memory of 2756	2704	inl92EF.tmp	38
PID 2704 wrote to memory of 2756	2704	inl92EF.tmp	38
PID 2704 wrote to memory of 2756	2704	inl92EF.tmp	38
PID 2704 wrote to memory of 2756	2704	inl92EF.tmp	38
PID 2756 wrote to memory of 2732	2756	cmd.exe	40
PID 2756 wrote to memory of 2732	2756	cmd.exe	40
PID 2756 wrote to memory of 2732	2756	cmd.exe	40
PID 2756 wrote to memory of 2732	2756	cmd.exe	40
PID 2704 wrote to memory of 2776	2704	inl92EF.tmp	44
PID 2704 wrote to memory of 2776	2704	inl92EF.tmp	44
PID 2704 wrote to memory of 2776	2704	inl92EF.tmp	44
PID 2704 wrote to memory of 2776	2704	inl92EF.tmp	44
PID 2704 wrote to memory of 2288	2704	inl92EF.tmp	45
PID 2704 wrote to memory of 2288	2704	inl92EF.tmp	45
PID 2704 wrote to memory of 2288	2704	inl92EF.tmp	45
PID 2704 wrote to memory of 2288	2704	inl92EF.tmp	45
PID 2288 wrote to memory of 2444	2288	iexplore.exe	47
PID 2288 wrote to memory of 2444	2288	iexplore.exe	47
PID 2288 wrote to memory of 2444	2288	iexplore.exe	47
PID 2288 wrote to memory of 2444	2288	iexplore.exe	47
PID 2776 wrote to memory of 2172	2776	cmd.exe	48
PID 2776 wrote to memory of 2172	2776	cmd.exe	48
PID 2776 wrote to memory of 2172	2776	cmd.exe	48
PID 2776 wrote to memory of 2172	2776	cmd.exe	48
PID 2172 wrote to memory of 744	2172	lie985B.tmp	49
PID 2172 wrote to memory of 744	2172	lie985B.tmp	49
PID 2172 wrote to memory of 744	2172	lie985B.tmp	49
PID 2172 wrote to memory of 744	2172	lie985B.tmp	49
PID 744 wrote to memory of 1012	744	cmd.exe	51
PID 744 wrote to memory of 1012	744	cmd.exe	51
PID 744 wrote to memory of 1012	744	cmd.exe	51
PID 744 wrote to memory of 1012	744	cmd.exe	51
PID 2704 wrote to memory of 2516	2704	inl92EF.tmp	53
PID 2704 wrote to memory of 2516	2704	inl92EF.tmp	53
PID 2704 wrote to memory of 2516	2704	inl92EF.tmp	53
PID 2704 wrote to memory of 2516	2704	inl92EF.tmp	53
PID 2516 wrote to memory of 2488	2516	cmd.exe	55
PID 2516 wrote to memory of 2488	2516	cmd.exe	55
PID 2516 wrote to memory of 2488	2516	cmd.exe	55
PID 2516 wrote to memory of 2488	2516	cmd.exe	55
PID 2488 wrote to memory of 2228	2488	ki2AF84.tmp	56
PID 2488 wrote to memory of 2228	2488	ki2AF84.tmp	56
PID 2488 wrote to memory of 2228	2488	ki2AF84.tmp	56
PID 2488 wrote to memory of 2228	2488	ki2AF84.tmp	56

Views/modifies file attributes 1 TTPs 6 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2700	attrib.exe
3032	attrib.exe
1720	attrib.exe
2972	attrib.exe
2604	attrib.exe
2860	attrib.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8a6cce77a711d9d113f98a58b6aa48a5.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat" "
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\inl92EF.tmp
    C:\Users\Admin\AppData\Local\Temp\inl92EF.tmp cdf1912.tmp
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat" "
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\ki19750.tmp
        
        C:\Users\Admin\AppData\Local\Temp\ki19750.tmp
        5⤵
        Server Software Component: Terminal Services DLL
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2732
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_lk_file.bat" "
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\lie985B.tmp
        
        C:\Users\Admin\AppData\Local\Temp\lie985B.tmp
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2172
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_rlh_tmp.bat" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:744
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 88.99.00.00
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1012
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\MICROS~1\NTUSER_LOG.hta"
        7⤵
        Modifies WinLogon for persistence
        Modifies visibility of file extensions in Explorer
        Drops desktop.ini file(s)
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies registry class
        
        PID:3068
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\MICROS~1\NTUSER~1.DAT,MainLoad
        8⤵
        Loads dropped DLL
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2732
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://tc.92mh.com/
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2288
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2444
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\run_ki2_tmp.bat" "
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\Users\Admin\AppData\Local\Temp\ki2AF84.tmp
        
        C:\Users\Admin\AppData\Local\Temp\ki2AF84.tmp
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2488
      - C:\Program Files\Common Files\19920306.exe
        
        "C:\Program Files\Common Files\19920306.exe"
        6⤵
        Executes dropped EXE
        
        PID:2228
      - C:\Program Files\Common Files\920306.exe
        
        "C:\Program Files\Common Files\920306.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:372
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c C:\Users\Admin\AppData\Local\Temp\~B809.bat "C:\Program Files\Common Files\920306.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:884
        
        C:\Windows\SysWOW64\mshta.exe
        
        "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\NTUSER_LOG.hta"
        8⤵
        Modifies WinLogon for persistence
        Modifies visibility of file extensions in Explorer
        Drops desktop.ini file(s)
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies registry class
        
        PID:2036
        
        C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\MICROS~1\NTUSER~1.DAT,MainLoad
        9⤵
        Loads dropped DLL
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:3004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\expand.exe
    expand.exe "C:\Users\Admin\AppData\Local\Temp\favorites_url.cab" -F:*.* "C:\Users\Admin\Favorites"
    3⤵
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:3068
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE > nul
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2096

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k imgsvc
1⤵
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Windows\system32\attrib.exe
attrib +s +h "D:\RECYCLERMD4"
1⤵
- Process spawned unexpected child process
- Sets file to hidden
- Views/modifies file attributes
PID:1720

C:\Windows\system32\attrib.exe
attrib +s +h "D:\VolumeXX\desktop.ini"
1⤵
- Process spawned unexpected child process
- Sets file to hidden
- Views/modifies file attributes
PID:2972

C:\Windows\system32\attrib.exe
attrib +s +h "D:\VolumeXX"
1⤵
- Process spawned unexpected child process
- Sets file to hidden
- Views/modifies file attributes
PID:2604

C:\Windows\system32\attrib.exe
attrib +s +h "D:\RECYCLERMD4"
1⤵
- Process spawned unexpected child process
- Sets file to hidden
- Views/modifies file attributes
PID:2860

C:\Windows\system32\attrib.exe
attrib +s +h "D:\VolumeXX\desktop.ini"
1⤵
- Process spawned unexpected child process
- Sets file to hidden
- Views/modifies file attributes
PID:2700

C:\Windows\system32\attrib.exe
attrib +s +h "D:\VolumeXX"
1⤵
- Process spawned unexpected child process
- Sets file to hidden
- Views/modifies file attributes
PID:3032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Server Software Component

T1505

Terminal Services DLL

T1505.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\920306.exe

Filesize
24.0MB

MD5
d444e411fc2850c502454ce8a1e0d7a1

SHA1
af71f9ea9cc2f7d8c06ce1c594be543ef20dcba0

SHA256
caf2fde46a89436b401e0478948d9b1312bcdd26166f6ac05b13c344c05fb3ec

SHA512
56422fc12205470ae6b828748cea3ed436a33b1c2f2f1a2da0e6331cf190433b0ee9ad442d2c9ff653dc08bd3e99de022f87952a9bc1169746ce31fd8e533ee5

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Internat Explorer.html

Filesize
496B

MD5
5cdbde2f4ccbc0524c69c7cafcd2c37f

SHA1
7a1a648ec802a253e44e8c53692e8346b0d3b243

SHA256
66a7b213220ac2ad40b06f80140c1d470438a14c9969b16cb24e6db76759c46f

SHA512
60baae2839607647ec1129ef553d266de7672bc6c3267381fb35d505c31a63e29b94312da91ce911e79bd9988d83771681ee195e9be1cbd16b204dbcbe8bc375

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
309db04a4ae089a3d9a86f961b8d6fae

SHA1
d1f48d1e76b5f287a0493124708303ac5005e898

SHA256
5caa5039bdf494974c39a9d3469bc4e60a8ae95927707d9370c028b94aae0f1c

SHA512
a96345d1fc0de5cc27e0afb4bd45c47f25824e32a11576dd42ba65e9c11ac3b7bd8681f6981e7965644918744dc6d55432e0ca4c8cf36b33bd23826702ecb776

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
37c2c7e61e070ee5aaeb360954a1707b

SHA1
ee0333d258f557af362e460b7c8cfbc86d700609

SHA256
e82f6c79f2f4160d024677a761f167f947c8e6df5ba4eef6e921d3501c258c62

SHA512
67400d3b8fc3bed2c9d315e44dc723ef4aca582e32c92e0efdee86d30fe188f3c473328ffa12d13d2226be9b306c5182451da931ec4c3be02dc817b8423d2fef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1ad52b427d0850cd6221bbc4454a94fd

SHA1
10e212881dfe8cecccf2032aac3c79ea70c37f84

SHA256
29f588432255b819fd7817e2e276befdcfdb42621bd6b19383ab5add481d924e

SHA512
b6eebf167f52056d6c6171da5513b3a528d16ed2e2fda21747bd48e44022518dacfe722a078931cb8e9d5c04b9b73f273440835480dfe9a370ce6826439b6c4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
153da18311f0a86195c30dfbdc0eaf61

SHA1
4c0cfff2b722667e03ae0c828905d0c557b479eb

SHA256
7543211b307b2116691879df21f6a87190e33414601197f771d86c43cc8ac581

SHA512
b128e729117ffffbda2c6909d682a45541d0e8fc436ca2cff69208c3cca18f282a8503e6daeeb60967302605ee112b1ac45981f5793bbaeae11ddf7621425a8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
582cc0c3cf33cdd3811ed79f94d4c474

SHA1
6314b6814040a81208712bd42c1eba41a8d8da6b

SHA256
8dbd80830ca97d699beae69e5abaeb5028831984f2b472677a37760eff3be4e9

SHA512
8079aa057f875f55c66f975288856aadb97c68cc7e90576b97ce765ed31461de670ad2d6d82218d98625cef2ae75c891c01fec3014cf9ac4e5f839d392169a19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91bb51071b7eeaf563f3c59979af1437

SHA1
0123cb76111e7a6f82bb84ea0e0713f27865df5f

SHA256
78631a3fd2d1602c038ecbf2fdfaaa59eb6e9b99cae3dce9f765fe8a48cb1a44

SHA512
7609b992c846ba6c0c683af94d770267dd3de7f990d2c9ab39b5e414961e5a69e0152cc8bb11805f853fff22605b93e6bb0c616797fd8853fc20c9b8d64c8a0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cc77f45cc1e1926baad87d638bf7fe3a

SHA1
d23ddbd8b786393abadd31380c6a0125f16cd267

SHA256
7d30316a06d0aa88f9110b2364eba323adc341f00f6fbc453b543e8d26f8eebf

SHA512
e14b3969468da4f12f4fb9b3ba63821aeabe972494550ffc371ef7e1e460a45f07177e61abeb23fc2316f1b436a04c0c8fd4f4d433cf31ebd1f5898629f0c1f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f0bbdef7927667a3930dc677647ee50

SHA1
b660a429fe8b9af4df8a4a96b87a593dc7d38b3f

SHA256
a8fc687a67d9fe5b0630723e1f8b143b3774965a024cf9c34f83cd189a7ac134

SHA512
9621d541dfe7696ed647f52d3bf614f3d4940d1ffb966859a5c0f18dba231dd5aca1b373eeda3e80138827b82bae5f7482d49aa1fa795cb7208145cbcd7d7307

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f9cc3955980c98b45a16c1629d08801c

SHA1
8d3363da8675e598375be292363c815f73e95a91

SHA256
871ae386bf43fd6e2751d242a5644a4a2935e8f0b0edb75d563c4bea7a54eb99

SHA512
aa9a7c862663bd11e35f5d12bfaf6e1afb5d32ca354587cbc6753374cbe341544f9e09c4268d162b43054f5d07ff881e19adb8c36561814369875f155a3342f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b40832b449a1cf9be3ba4564e6980bcb

SHA1
1b4a26c8cd204ab1e229d1eddd751a2e75b081ed

SHA256
1de664231137a6bd5c1cbafbfedd38fa00eb607833be6e91f451a77c26fe4216

SHA512
3d4ad8dab0042ef72e24d0034d2ce1582006fe27a84dd78607589ee9dd8aa78d19fb8ff294f187c9ffc7a03373b1bdc434f8292edab74d73183c26de114c9d57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
59e8668f50f1163e84b4373cec4721f0

SHA1
713eca9bd3a910376f224bb0e349b5ab18d75378

SHA256
924fda8abd0058548db3aa89dff15affcb23406794f519ca3bdb9b39e351d3d1

SHA512
274abd338d99016264beaed75d5410f9b57a1e25a336e3c65184c5bedb7a28e57af002145a727f69f19470559536326e9ebbcb79557e6ef36743274b05476238

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
33c57bd9f3f328403211fe33e0bf480b

SHA1
499c2e8016eb94f23a4cf96a47908f6efdaae442

SHA256
10fe7529fcff9537cdfd6360778fe6b2c405b7d34c0e44b035dcffad8a608a89

SHA512
1001b74e5563a1444da3b1672bb5b8c2445096a3e407d1eefebb64c51a6f58d3aec7aa72afa7223ef2ff879d871df4bc9fb4ff1b5757a1b3c72bc21313b9fa78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9b84350dccd6271d239d7a8d7dc7b5fc

SHA1
576ba0a69b8fa936f9c89a8f32ee8458a9ba58f3

SHA256
6b0b6000fe0c4bc9efa994ee08574550e533d4f5415da5fad9f547a135449eb3

SHA512
1225b35aeca83da7720b7d98e2d117ab68835d000848df2526762bb4b9e39653ab0c014cbc3a458b1b10216c9b892210b30bb5533d7e649e991d066a316fbfe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8fe904580c4faa8093f365a3fb1b611d

SHA1
6c781b421b6f302563ceb912fce740472bb77eaf

SHA256
5abfc151161db1a2b21d80f3183ba11fec4377dfa25d4b50b8a6e9ce009a9389

SHA512
305f7234f828821dfbf4a7a31605c2271bcb3bc3770e330d276c6e8f6b1dc75133d0f8848bdca2b8465e9a5b420be33506b7b5e90e556fbfd4e3d5edc3c44a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b8125ff1ca3f8ab029a2756f9d1d5434

SHA1
ba4f71724816dddeb6dc0cefb46b137e20b91db0

SHA256
8060762599662c5697bcd32a344b47f6bc14eb37c67a5b801415e979e4b66807

SHA512
579731ea30f6c159bd979aa63b400b55bca2cbca340fd9fa36ef2dd2e6a25f7d5e84292230f8d105b0ca6789ee3faebc8f51978eb19d5ae323d3ad8c25734b06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
78a9e0d01ff3c0ae508877fdba3486bb

SHA1
6d22cc08f600c2fb274c7d7bf71e69e1e86794a5

SHA256
f9f31cd9bfafef70fed948f2ed0934e172006a2bf90d37848d503ff44694747b

SHA512
89470530afea84452a506254cb15412bba7ef03afb2ff8b909055e5597c970134407e09b0941beaa5895ae62976cc203de9fe9d1b59532a95179f812132bb69f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f45d8d924c71661f385ba2cfbd5c0fd3

SHA1
8735cbe0673becbd409ce0c4d7a4dfa35002f532

SHA256
239046e2f3182f9f458a42f11405fb0db9e95a84522a0bf94df7be327af1c7d6

SHA512
e0de2f767ca8562890853ad4c8e6fb06b8a1179cb82e9f4466448d1919187ea6abddc4bc6be987a4b38c04758cc6deb39eb04b72989a5354de6b6405be68a2f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
959eda2cab4442f64ad73230b6af51bb

SHA1
cc45f1b82f7499818bdba186e2e373a7cedfaada

SHA256
0cb43ab7fc7878f6529b348626982ec561b4c2e3bd9337303bc0e9792b630892

SHA512
8e6c2f667c17e7174078f808bbe12680f2c0febd2dfa3d012a2c2ce797a4f73efe96bcbe5eaf5cfe21afe3f8e8364a9812ae1c813b91f4134993404ac4fb98c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43dff27850c8a66c9ca91039acf5fa48

SHA1
a4fcbcef37552c79179741471972b3bc6fe728b7

SHA256
5b0f6d4bfac4afb1c1d3f769d7f1a68b8a32d89d0f26f918e9f597b77458a8b5

SHA512
18d75315788773580a915c351e093810f75d03608f5bab523e35bcd25800db54ca01ccbbff7d843bbc21b30ab8242ac1944de9c8091c510af85e72189ebe7910

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
76907a435e42d920488d15ff7819caf4

SHA1
0924bfac2f6f8f866e8cb582319af6624fc0c5ba

SHA256
1595d5c4a0a0e2e70890475ce1b74ce2b4a71ee695c6b6da9f17ece021be83bd

SHA512
55eaf8796214b0d7a9434e56e33ff664a2966e6d8b99fd48db7a5c4bc3f9c9a16064a318d16e207f21dd02b08728cd2cb8661b26209761f90678ffecede968f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
5c1a1a448923928e65f6366cd62334ea

SHA1
869a23f38983d30131a660404f69db0f3302027a

SHA256
1181ad569d0879152c3dc818633cef9520c66dca9a82f30ca9236bf58596fbd7

SHA512
eb3444d509c958f8db487663aceba65402b88fdde04f2f0f7d1f9fb7edabc9531a3de90742cab7d11355999ce676bd4d9f3beaeb850dcb805965d184af7f02d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCB6D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCCEA.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\cdf1912.tmp

Filesize
768B

MD5
d20d9eda31a2d0300e4589df7f352370

SHA1
79b46d2dbb489914cfedafdbc90e62951471b48e

SHA256
d7a1d6a8cf5c3fbb85cd06147a599f5274630b86b1c89721f10a60c1bbe994d8

SHA512
d28c5b69325a9833776ea362445b77b231a0ec9b9b8b4a2ad37a434ee8b2b0c1903d6ade1e372f73ac8ada951e0a24076cf23d9307d27fed5927f4bf8b0d0a5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\run_dws_file.bat

Filesize
57B

MD5
fb47ced20a6f7542fa07d3c7d49c5f60

SHA1
f7e2527012913f505a06937abb8b6f1cda136edc

SHA256
25807d85ac305105f79c7d5875b510472a2555e4c645a28c09db94ae6c68594a

SHA512
eb0b4d1401592d452a5b7878988c2cdbab3db9d6d74c24dbd44aade9eb91776b12109f17f71f46b25cbc11262d45a676696a9325cba5d9b029ad2b63f88c383b

Download Submit
C:\Users\Admin\AppData\Local\Temp\run_ki2_tmp.bat

Filesize
45B

MD5
dcc311b8da0ba49612b11082203afd35

SHA1
48614dc28602a1966b603c80e3baeaaa08be1918

SHA256
033912dfca7b89b83c71bb69296c45a8f76ed6513841aecba509abfdd74a108a

SHA512
ab19843ff4cc2348e257f9cfbdb1b4ca9321e9d62ea38291c0ac5ceacb96b2b761d74955190c0689a065eb25c3257205a4a4f230921e4af8b7354567ffb0203f

Download Submit
C:\Users\Admin\AppData\Local\Temp\run_kl_file.bat

Filesize
45B

MD5
68cd74980973e52b124d7b6d82e440b1

SHA1
3ac6925404a355ade4cb2b6e092461f642aba765

SHA256
6cdab89fd9e998dfddf0739d9494a65a521c431fc384f8c19d556690b1d8db3c

SHA512
3faaaa6075d451db3719c20960b85660967a6b15eea5f66ab02d916358e53a2b130cce1f8864ec9b69c892f5b25e9159c873e24df73bf68db4d46cca9a95ebc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\run_lk_file.bat

Filesize
45B

MD5
ac184a59a18aabbadbefb7572a93f529

SHA1
6661ddc7513b9eca8bd7a5dc1e19ebbe8bd7ff91

SHA256
61d82e0d67b535eb0ea500128e1eb514060e3ebbd1888acd1c614cfbd7f67787

SHA512
affd35890e2e0e5cbeb226aa70d855834fcb01a196688462a62c98eddcc92ecf16ed07859ac3ad5d05f95c7ce3a1cb2e2f1390c5f4e67a53844def099e3c8888

Download Submit
C:\Users\Admin\AppData\Local\Temp\run_rlh_tmp.bat

Filesize
70B

MD5
edea5cd5060d69b6c558fea75e330a67

SHA1
929e7c5ca8c300a98ac6833d0e8fa912ca9fa5dd

SHA256
1ed1bc8bfd84479497b2c1e3d0ca1df56eb2f3d82a68862e8b50eead06889b39

SHA512
adbe14c811b915972709530049bb6934eacead6c5d19243ecea07abdd6c93aeede3fcae99f6419fb7ca1b2394dcef19e642be36f22c572de01b069dac2b4aa61

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_ext_favurl_cab.bat

Filesize
98B

MD5
8663de6fce9208b795dc913d1a6a3f5b

SHA1
882193f208cf012eaf22eeaa4fef3b67e7c67c15

SHA256
2909ea8555f2fc19097c1070a1da8fcfd6dc6886aa1d99d7e0c05e53feeb5b61

SHA512
9381063e0f85e874be54ae22675393b82c6ab54b223090148e4acbeff6f22393c96c90b83d6538461b695528af01d1f1231cf5dc719f07d6168386974b490688

Download Submit
C:\Users\Admin\AppData\Local\Temp\~B809.bat

Filesize
49B

MD5
b6e4ff01afc2e58b21843019507108c9

SHA1
01a3700dae89c5106a748af13f65b28c7c462d23

SHA256
7ca924de77456773a89cb7663463bedadf931deb66e02dd12498607f8540a564

SHA512
f70ed29c7ccd1647b0de0d2d5af321d7c32a1b324c3bfdea82a395011cd7e9727fe45ef77ffa3d795e9f6e215973a05ca5a9682e751b800f433fcc86b5909dcf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\NTUSER_LOG.hta

Filesize
7KB

MD5
d533fbcf6eec4c957935d4e81fbfcb56

SHA1
2fabf149662dadb7236766fa111e33990baa5def

SHA256
441f1948e33f12dd65b3f69dfdf34cfe3a3ab8c0cfbb32aa5502704386e5cdd4

SHA512
10f105a4c40dcac0a28f3f547850f9237a0f69158990dccaa198b3fd8d84b6f6c26c7c9e8ba353d813b80eaf98b8f620bb0e79bcbcdedde8b8c06906ba6f791b

Download Submit
\??\c:\users\admin\appdata\local\temp\favorites_url.cab

Filesize
425B

MD5
da68bc3b7c3525670a04366bc55629f5

SHA1
15fda47ecfead7db8f7aee6ca7570138ba7f1b71

SHA256
73f3605192b676c92649034768378909a19d13883a7ea6f8ba1b096c78ffadb5

SHA512
6fee416affcb6a74621479697bca6f14f5429b00de3aa595abe3c60c6b2e094877b59f8783bbe7bdd567fa565d0630bb02def5603f8f0ea92fe8f2c3ac5383c0

Download Submit
\??\c:\windows\SysWOW64\6ovudn.dll

Filesize
24.1MB

MD5
5dbe23408f86a22ac358294d192a1ee5

SHA1
45fd428c3075603b2d15f6b51839c2ca48ffb9f5

SHA256
cd1693fdd0f2ced0a46a1199b32a59d2f5aeacd13c839411618540d856627b60

SHA512
4d4b3750bd23bde4fe257594b3d638e0eec695108ce52c75515c9ed42eacfc69d7c70d7284cb334a4ddd34e7e94590877aca6e6cf6cd257967c42d87005de769

Download Submit
\Program Files\Common Files\19920306.exe

Filesize
24.1MB

MD5
804e98e11fe38603675036b9126d3d5a

SHA1
774f92b488e6ba8dd6433d3cd9e64f9a3e9c6b6a

SHA256
5cbf6f759dd33eaa64d0421bdcd37acb2e93b13b62b2a700d4133e7d199e6912

SHA512
16423ab22c1a6bd13ce8655e8c93fec9f272a4cebea913f76bc7a5cbb9aabc816c4eb2b9e7dce8dd4b788d5076c91e155ff538283d7193d6694de730bb9537a2

Download Submit
memory/372-163-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/372-561-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1972-77-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1972-79-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/1972-82-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1972-197-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/1972-86-0x0000000020000000-0x0000000020027000-memory.dmp

Filesize
156KB

Download
memory/2172-121-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2460-130-0x00000000001D0000-0x0000000000239000-memory.dmp

Filesize
420KB

Download
memory/2460-124-0x00000000001D0000-0x0000000000239000-memory.dmp

Filesize
420KB

Download
memory/2460-52-0x00000000001D0000-0x0000000000239000-memory.dmp

Filesize
420KB

Download
memory/2488-147-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2488-162-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/2488-161-0x0000000000020000-0x0000000000033000-memory.dmp

Filesize
76KB

Download
memory/2488-167-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2516-143-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2516-146-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2628-30-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2628-29-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2628-8-0x0000000000660000-0x0000000000670000-memory.dmp

Filesize
64KB

Download
memory/2628-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2628-1-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2704-56-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2704-55-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2704-123-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2704-80-0x0000000000020000-0x0000000000023000-memory.dmp

Filesize
12KB

Download
memory/2704-92-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2704-81-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2704-539-0x0000000000400000-0x0000000000469000-memory.dmp

Filesize
420KB

Download
memory/2732-78-0x0000000023560000-0x0000000023595BE0-memory.dmp

Filesize
214KB

Download
memory/2732-73-0x0000000023560000-0x0000000023595BE0-memory.dmp

Filesize
214KB

Download
memory/2732-720-0x000000006A6C0000-0x000000006A6CC000-memory.dmp

Filesize
48KB

Download
memory/2756-70-0x0000000023560000-0x0000000023596000-memory.dmp

Filesize
216KB

Download
memory/2776-106-0x0000000000100000-0x000000000010F000-memory.dmp

Filesize
60KB

Download
memory/2776-108-0x0000000000100000-0x000000000010F000-memory.dmp

Filesize
60KB

Download
memory/3004-563-0x000000006A6C0000-0x000000006A6CC000-memory.dmp

Filesize
48KB

Download
memory/3004-722-0x000000006A6C0000-0x000000006A6CC000-memory.dmp

Filesize
48KB

Download