Analysis
- max time kernel
150s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/09/2026, 23:43
Behavioral task
behavioral1
Sample
jaffacakes118__157ac962e525c712d109d45ded1568dd.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118__157ac962e525c712d109d45ded1568dd.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
26 signatures
150 seconds
General
- Target jaffacakes118__157ac962e525c712d109d45ded1568dd.exe
- Size 255KB
- Sample260920-3qtyvaea85
- SHA256 4fbac644caf4153f58726ce5f5acb845f3cafa533502300d9334a52dfb578229
- MD5 157ac962e525c712d109d45ded1568dd
- SHA1 cf47513ec1fc6787a2eeec17aae93133a6c67318
- SHA512 056aebbe69bf8100b485b1c5d978e86d48734da22890b74943bf9da1b612871efd332825c9813c31988ca3debc25bde1417f1e1fd6864432f93cea57d86665bf
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJO:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIx
- TLSH T1384413C2A6D95AF5ECC619771A23DF841F56FE3169C60910BA04B16F49F73C1AA13323
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" meyxgqfkvo.exe - Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" meyxgqfkvo.exe - Windows security bypass 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" meyxgqfkvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" meyxgqfkvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" meyxgqfkvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" meyxgqfkvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" meyxgqfkvo.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" meyxgqfkvo.exe - Executes dropped EXE 5 IoCs
pid Process 2900 meyxgqfkvo.exe 3328 tdpjzcpmaicadgd.exe 5972 rmtyqfha.exe 3376 idflueqwdaqar.exe 2796 rmtyqfha.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" meyxgqfkvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" meyxgqfkvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" meyxgqfkvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" meyxgqfkvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" meyxgqfkvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" meyxgqfkvo.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uwmgilsm = "meyxgqfkvo.exe" tdpjzcpmaicadgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jpmpaljo = "tdpjzcpmaicadgd.exe" tdpjzcpmaicadgd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "idflueqwdaqar.exe" tdpjzcpmaicadgd.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\t: meyxgqfkvo.exe File opened (read-only) \??\m: rmtyqfha.exe File opened (read-only) \??\k: meyxgqfkvo.exe File opened (read-only) \??\r: meyxgqfkvo.exe File opened (read-only) \??\t: rmtyqfha.exe File opened (read-only) \??\p: rmtyqfha.exe File opened (read-only) \??\q: rmtyqfha.exe File opened (read-only) \??\g: rmtyqfha.exe File opened (read-only) \??\k: rmtyqfha.exe File opened (read-only) \??\o: rmtyqfha.exe File opened (read-only) \??\x: rmtyqfha.exe File opened (read-only) \??\z: rmtyqfha.exe File opened (read-only) \??\g: rmtyqfha.exe File opened (read-only) \??\t: rmtyqfha.exe File opened (read-only) \??\y: rmtyqfha.exe File opened (read-only) \??\z: rmtyqfha.exe File opened (read-only) \??\p: meyxgqfkvo.exe File opened (read-only) \??\n: rmtyqfha.exe File opened (read-only) \??\r: rmtyqfha.exe File opened (read-only) \??\l: rmtyqfha.exe File opened (read-only) \??\m: meyxgqfkvo.exe File opened (read-only) \??\k: rmtyqfha.exe File opened (read-only) \??\w: meyxgqfkvo.exe File opened (read-only) \??\u: rmtyqfha.exe File opened (read-only) \??\y: rmtyqfha.exe File opened (read-only) \??\j: rmtyqfha.exe File opened (read-only) \??\n: meyxgqfkvo.exe File opened (read-only) \??\v: rmtyqfha.exe File opened (read-only) \??\j: rmtyqfha.exe File opened (read-only) \??\m: rmtyqfha.exe File opened (read-only) \??\s: rmtyqfha.exe File opened (read-only) \??\b: meyxgqfkvo.exe File opened (read-only) \??\q: meyxgqfkvo.exe File opened (read-only) \??\h: rmtyqfha.exe File opened (read-only) \??\o: rmtyqfha.exe File opened (read-only) \??\i: meyxgqfkvo.exe File opened (read-only) \??\j: meyxgqfkvo.exe File opened (read-only) \??\z: meyxgqfkvo.exe File opened (read-only) \??\b: rmtyqfha.exe File opened (read-only) \??\i: rmtyqfha.exe File opened (read-only) \??\a: rmtyqfha.exe File opened (read-only) \??\d: rmtyqfha.exe File opened (read-only) \??\r: rmtyqfha.exe File opened (read-only) \??\d: meyxgqfkvo.exe File opened (read-only) \??\l: meyxgqfkvo.exe File opened (read-only) \??\s: rmtyqfha.exe File opened (read-only) \??\a: meyxgqfkvo.exe File opened (read-only) \??\u: meyxgqfkvo.exe File opened (read-only) \??\v: meyxgqfkvo.exe File opened (read-only) \??\n: rmtyqfha.exe File opened (read-only) \??\x: meyxgqfkvo.exe File opened (read-only) \??\y: meyxgqfkvo.exe File opened (read-only) \??\l: rmtyqfha.exe File opened (read-only) \??\w: rmtyqfha.exe File opened (read-only) \??\h: meyxgqfkvo.exe File opened (read-only) \??\b: rmtyqfha.exe File opened (read-only) \??\g: meyxgqfkvo.exe File opened (read-only) \??\o: meyxgqfkvo.exe File opened (read-only) \??\p: rmtyqfha.exe File opened (read-only) \??\d: rmtyqfha.exe File opened (read-only) \??\h: rmtyqfha.exe File opened (read-only) \??\i: rmtyqfha.exe File opened (read-only) \??\u: rmtyqfha.exe File opened (read-only) \??\v: rmtyqfha.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" meyxgqfkvo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" meyxgqfkvo.exe - AutoIT Executable 59 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4168-32-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-63-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-64-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5972-77-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-78-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5972-81-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-79-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-82-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-80-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2796-95-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2796-94-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-443-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-441-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5972-442-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-440-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2796-476-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-517-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-518-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-520-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5972-519-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2796-523-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5972-530-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-531-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-529-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-528-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2796-532-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-534-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-536-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-533-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5972-535-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2796-537-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-540-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5972-542-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-543-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-541-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2796-545-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2796-547-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5972-546-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-548-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-549-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-550-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-551-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-552-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-553-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-554-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-555-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-556-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-557-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-558-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-559-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-576-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-578-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-577-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-579-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-581-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-580-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-582-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-584-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3328-583-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\tdpjzcpmaicadgd.exe jaffacakes118__157ac962e525c712d109d45ded1568dd.exe File created C:\Windows\SysWOW64\idflueqwdaqar.exe jaffacakes118__157ac962e525c712d109d45ded1568dd.exe File opened for modification C:\Windows\SysWOW64\idflueqwdaqar.exe jaffacakes118__157ac962e525c712d109d45ded1568dd.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rmtyqfha.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rmtyqfha.exe File created C:\Windows\SysWOW64\meyxgqfkvo.exe jaffacakes118__157ac962e525c712d109d45ded1568dd.exe File opened for modification C:\Windows\SysWOW64\meyxgqfkvo.exe jaffacakes118__157ac962e525c712d109d45ded1568dd.exe File created C:\Windows\SysWOW64\rmtyqfha.exe jaffacakes118__157ac962e525c712d109d45ded1568dd.exe File opened for modification C:\Windows\SysWOW64\rmtyqfha.exe jaffacakes118__157ac962e525c712d109d45ded1568dd.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll meyxgqfkvo.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe rmtyqfha.exe File created C:\Windows\SysWOW64\tdpjzcpmaicadgd.exe jaffacakes118__157ac962e525c712d109d45ded1568dd.exe -
resource yara_rule behavioral2/memory/4168-0-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000d00000001c4cf-6.dat upx behavioral2/files/0x000e00000001c4c9-13.dat upx behavioral2/files/0x000d00000001c4ce-17.dat upx behavioral2/files/0x000d00000001c4d0-25.dat upx behavioral2/memory/4168-32-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-63-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3328-64-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000d00000001c4ed-68.dat upx behavioral2/files/0x000d00000001c4ee-71.dat upx behavioral2/files/0x000d00000001c4f0-75.dat upx behavioral2/memory/5972-77-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3376-78-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5972-81-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-79-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3376-82-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3328-80-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2796-95-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2796-94-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3376-443-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3328-441-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5972-442-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-440-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2796-476-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-517-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3328-518-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3376-520-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5972-519-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000e00000001c582-521.dat upx behavioral2/memory/2796-523-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000e00000001c582-524.dat upx behavioral2/memory/5972-530-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3376-531-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3328-529-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-528-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2796-532-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3328-534-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3376-536-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-533-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5972-535-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2796-537-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-540-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5972-542-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3376-543-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3328-541-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2796-545-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2796-547-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5972-546-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-548-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3328-549-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3376-550-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-551-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3328-552-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3376-553-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-554-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3328-555-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3376-556-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-557-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3328-558-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3376-559-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-576-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3376-578-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3328-577-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-579-0x0000000000400000-0x00000000004A0000-memory.dmp upx - Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rmtyqfha.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rmtyqfha.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rmtyqfha.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal rmtyqfha.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rmtyqfha.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rmtyqfha.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe rmtyqfha.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal rmtyqfha.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rmtyqfha.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rmtyqfha.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rmtyqfha.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal rmtyqfha.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe rmtyqfha.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal rmtyqfha.exe - Drops file in Windows directory 11 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe rmtyqfha.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe rmtyqfha.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe rmtyqfha.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe rmtyqfha.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe rmtyqfha.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1150_none_a9b280b0a5669e69\MsoIrmProtector.doc.exe rmtyqfha.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe rmtyqfha.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.26100.1_none_151382ec926a1266\MsoIrmProtector.doc.exe rmtyqfha.exe File opened for modification C:\Windows\mydoc.rtf jaffacakes118__157ac962e525c712d109d45ded1568dd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language idflueqwdaqar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rmtyqfha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118__157ac962e525c712d109d45ded1568dd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language meyxgqfkvo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tdpjzcpmaicadgd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rmtyqfha.exe - Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat meyxgqfkvo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh meyxgqfkvo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" meyxgqfkvo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs meyxgqfkvo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg meyxgqfkvo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "334E2C7D9D2082576A4477D170202CAE7CF164D6" jaffacakes118__157ac962e525c712d109d45ded1568dd.exe Key created \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings jaffacakes118__157ac962e525c712d109d45ded1568dd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" meyxgqfkvo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" meyxgqfkvo.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes jaffacakes118__157ac962e525c712d109d45ded1568dd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC8FAB0FE14F193847A3B42819B39E3B08E02FD43120338E1CA42E708D5" jaffacakes118__157ac962e525c712d109d45ded1568dd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB2B15C449538EB52CFBAD4329DD7BC" jaffacakes118__157ac962e525c712d109d45ded1568dd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EF8FF834826851D903DD75B7E94BC95E13659466646633FD6ED" jaffacakes118__157ac962e525c712d109d45ded1568dd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F468B2FE6921DFD279D0A28B7A9167" jaffacakes118__157ac962e525c712d109d45ded1568dd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc meyxgqfkvo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf meyxgqfkvo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184AC70E1594DBC2B8BC7CE8ED9434C6" jaffacakes118__157ac962e525c712d109d45ded1568dd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" meyxgqfkvo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" meyxgqfkvo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" meyxgqfkvo.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4968 WINWORD.EXE 4968 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 2900 meyxgqfkvo.exe 2900 meyxgqfkvo.exe 2900 meyxgqfkvo.exe 2900 meyxgqfkvo.exe 2900 meyxgqfkvo.exe 2900 meyxgqfkvo.exe 2900 meyxgqfkvo.exe 2900 meyxgqfkvo.exe 2900 meyxgqfkvo.exe 2900 meyxgqfkvo.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 5972 rmtyqfha.exe 5972 rmtyqfha.exe 5972 rmtyqfha.exe 5972 rmtyqfha.exe 5972 rmtyqfha.exe 5972 rmtyqfha.exe 5972 rmtyqfha.exe 5972 rmtyqfha.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 2900 meyxgqfkvo.exe 2900 meyxgqfkvo.exe 2900 meyxgqfkvo.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 5972 rmtyqfha.exe 5972 rmtyqfha.exe 5972 rmtyqfha.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 2796 rmtyqfha.exe 2796 rmtyqfha.exe 2796 rmtyqfha.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 2900 meyxgqfkvo.exe 2900 meyxgqfkvo.exe 2900 meyxgqfkvo.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 3328 tdpjzcpmaicadgd.exe 5972 rmtyqfha.exe 5972 rmtyqfha.exe 5972 rmtyqfha.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 3376 idflueqwdaqar.exe 2796 rmtyqfha.exe 2796 rmtyqfha.exe 2796 rmtyqfha.exe - Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 4968 WINWORD.EXE 4968 WINWORD.EXE 4968 WINWORD.EXE 4968 WINWORD.EXE 4968 WINWORD.EXE 4968 WINWORD.EXE 4968 WINWORD.EXE 4968 WINWORD.EXE 4968 WINWORD.EXE - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4168 wrote to memory of 2900 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 89 PID 4168 wrote to memory of 3328 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 90 PID 4168 wrote to memory of 5972 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 91 PID 4168 wrote to memory of 3376 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 92 PID 4168 wrote to memory of 4968 4168 jaffacakes118__157ac962e525c712d109d45ded1568dd.exe 93 PID 2900 wrote to memory of 2796 2900 meyxgqfkvo.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118__157ac962e525c712d109d45ded1568dd.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__157ac962e525c712d109d45ded1568dd.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\meyxgqfkvo.exemeyxgqfkvo.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\rmtyqfha.exeC:\Windows\system32\rmtyqfha.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2796
-
-
-
C:\Windows\SysWOW64\tdpjzcpmaicadgd.exetdpjzcpmaicadgd.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3328
-
-
C:\Windows\SysWOW64\rmtyqfha.exermtyqfha.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5972
-
-
C:\Windows\SysWOW64\idflueqwdaqar.exeidflueqwdaqar.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3376
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4968
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Impair Defenses
2Disable or Modify Tools
2Modify Registry
6Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\TCD7FFA.tmp\iso690.xsl
- Size 263KB
- SHA256 3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5
- MD5 ff0e07eff1333cdf9fc2523d323dd654
- SHA1 77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4
- SHA512 b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d
- SSDEEP 6144:JwprAiaR95vtfb8pDbgWPzDCvCmvQursq7vImej/yQ4SS1apSiQhHDOruvoVeMUX:We
- TLSH T1094469A5E6D9CF144BB1F23FD8A53092EA1DC87B29341D41F1DC733717AE948822B662
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JoinUpdate\SwitchHide.doc.exe
- Size 255KB
- SHA256 f7b5c95d5b7cbb82c517c74807f452f3586a1872ec45d503b2d24698f1631467
- MD5 a01757e35ff35d5749fcd4d11bfea88f
- SHA1 d81ddceedcc032ba524dacfd657d991a94ab24e3
- SHA512 39043724d0e39e840f0931c24b85b3d449776c70178492768089848db21bef60982e684df48db73a5e61e04432b88f2931f25d309a9a33802ad184dfe8473cbc
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJL:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIK
- TLSH T11F4413C2A6D95AF5ECC619771A23DF841F56FE3169C60A10BA04B16F49F73C1AA13323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\MeasureJoin\DismountFind.doc.exe
- Size 255KB
- SHA256 9ce87e5cc53734c2339195968be089cbc6876336d88c5c1ad1a1938a70dae513
- MD5 b9cfbb76227053d4bd01bcbca4d22193
- SHA1 feb3d468ee8e325c7e14df5faa274d47eb38cd33
- SHA512 1294164a08373bda560b732d85e251789a66faad512e21ac8dfc4689f64eebc4010bf59579273428db8693deb4012dd318be1f6a91469ea7687852a668349205
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJP:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIy
- TLSH T1654412C2A6D95AE5ECC619771A23DF841B56FE3169C60A10BA04B16F49F73C1AA13323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
- Size 297B
- SHA256 4b4acbf37315c9160aa6d11918c2e6be99016b7083a73a53b88cc92e94d7ede2
- MD5 b2df73c822efc2a245107dc68b4912b4
- SHA1 2ec14243d5b2cea33c7b79ed5888d612018f464b
- SHA512 9b8075f568785b915cd2fa83cb33fe9c31cd016aac447a94b1e9eb516a78cedf7a500c8dc1a26fc4e8d0c615e51df844dade735681a91e7587be755fbb740320
- TLSH T173E012277354E3F0177C63083E7C9CD467F18C94D30E501610CC2E521D66E43605B5AD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 2KB
- SHA256 aae361fb7d0a91e0043c79fb494f0138120b5b3778b06918d80c68ff9f54fa1a
- MD5 d20d1a3bb943e63f55dd7c56fa0b52f8
- SHA1 986dc3cdad9047cc80ffbf885388360e12c583f8
- SHA512 b07b9a068b1a1e51cf6d39bbd7dc7029ccbe5d2ff64e00a2568dd442179acc3079b833f6ce3212833b7295019160754faa4528230b48f6f2808e65fd84113fbe
- TLSH T1F451F1024A8F6F5FE0844376272D470DD6397D03F511B60EA2867117AE34E808FADA1B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
- Size 3KB
- SHA256 1f8b6433f53f723e9456431e8251d69992c3544b2f2c62d32e89bdf5bbfda32c
- MD5 6ad43ca9ff209cd4f39ec3259b57448b
- SHA1 f844736e5abc53326163a91e7ad07c0fe6192fd2
- SHA512 d6a13053d1eb0f4681750c6ec79038ed944386d9c401f259dbc963cbd443900ca03da932bc74b6f2fc87d638090af1796129f76d264d4ac8d62ec440a4f8d2a7
- TLSH T15651F2020A8F6F9FE0854336261D470AD7397D07F615A60EA3867157BE30E808FADA5F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Documents\TestWait.doc.exe
- Size 255KB
- SHA256 4c4a9bc4dda364126bcf7dd8da4a06ebf394acd330c2a73a87807247842f5286
- MD5 eaaa5298276dfd9097831b381af125a7
- SHA1 78caac21a52b6315d170aacc947095f9831b1b46
- SHA512 898bd152b2fd94f85fb67c7db73d57b0669842b5e2f4e6c5c30452284c9e720dfb0113aa3d9d94eee67482012c1b2fa47d2507126b4e3bd70ebdf7d06717909d
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJl:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIg
- TLSH T1604412C2A6D95AF6ECC619771A23DF841B56FE3169C60910BA04B16F49F73C1AA13323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\idflueqwdaqar.exe
- Size 255KB
- SHA256 84cac982e53953ed80893b4c10659bc02b171f978519ff0225bf6bbd46ae4a4e
- MD5 4cb999203cddc35efc6718294ecd897f
- SHA1 e192094ac98e96367aa78bfdca5d0acd78c3c9ba
- SHA512 e3505a2df9f9541576c11e89597fb7ab1211b771dd26a7a6b2c6ce52fec3b6deb331d5ada841550ea535856f2c1a678ba64b0af46361979ed3eaf5d017d9fec0
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ5:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIo
- TLSH T1A04413C2A6D95AF6ECC619771A23DF841F56FE3169C60910BA04B16F49F73C1AA13323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\meyxgqfkvo.exe
- Size 255KB
- SHA256 a8d5cf7a80fe2735fb8efe38e83cb04d27b2afb27d585d1790d31cbee9a64e33
- MD5 d21932ceaa54328326e9adcc034c326b
- SHA1 e64c57c863b9873f25cd3d9d057854a880a9d0f3
- SHA512 78d397df7e49afb14deeb8ba8048842bcdf2182e6adc9b8dd4d5ef58ca6152f5b018df46eddf13904b3ab4d9d777bbe15efbc8e13a76ceb77e7ebe8f070bbeee
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ1:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIY
- TLSH T1C24413C2A6D95AF5ECC619771A23DF841F56FE3169C60910BA04B16F49F73C1AA13323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\rmtyqfha.exe
- Size 255KB
- SHA256 ee2b77869f2887acbe95a8715abfa2548a63906444a793858585718bff5da9e1
- MD5 208b8ef3f2a4d617d09e375f492e7468
- SHA1 68a14911024c5f6fe854f536b4ebe485635a09b6
- SHA512 007db7d1b69225b5b7d08f7724b3b19adecc8dc16277635210c8eb7f10adfe889cd0dd1182bacd795e8e22e2f67f0ed2d925573d6711ab47137b75d74e3b3045
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJj:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIG
- TLSH T12F4413C2A6D95AF5ECC619771A23DF841F56FE3169C60910BA04B16F49F73C1AA13323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\tdpjzcpmaicadgd.exe
- Size 255KB
- SHA256 9233a83d548caae1bbf5003db7922df431deb362edf09f89e6f59a4554b06b68
- MD5 a31678b06e96456c836f81d1192d54da
- SHA1 e8e11ff84c26ca00ba4b71d031a5d52c5c8a89f3
- SHA512 79b2414ae1531f384d8cac4a4838548e922c5758e7c3e4dbc413562e8f3b0d8a3ffd5d9485567e43696929bb51584b83947eb392ebf791bc09dfe8e900480fbe
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJx:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIw
- TLSH T1914413C2A6D95AF5ECC619771A23DF841F56FE3169C60A10BA04B16F49F73C1AA13323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- TLSH T190D0972B140C00DC10C762CCEAD8013E43C5824078A2F89090B60D53B0263288986060
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 255KB
- SHA256 3186b88a3192d3d3236bc65bceb48b5db4a864369b629e109e1e5619d036b988
- MD5 60ff5f418f5e399d1ebb81ccee6c36a5
- SHA1 28f1ae1cc858a7ef2ef20726f8bceadbb5b99930
- SHA512 4ed7d8c33424b0787d5606047f0a4a295d4697b7a3f20f5788fd4e9a794bad70013b9f843c6b00eae7e15e8a704e621dbb7c9a612419fd27767429856b1f300e
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJm:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIj
- TLSH T1524413C2A6D95AF5ECC619771A23DF841F56FE3169C60910BA04B16F49F73C1AA13323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 255KB
- SHA256 55f33ed38f892a3c528e9ba3538a56366afbe43401d9e8cbab37fc58a97192da
- MD5 063d6e257b0f23a7f7d5f2cd0c763c87
- SHA1 83cf48c5802f430e5650fd7ed09067078534c60f
- SHA512 4d5a303b1ccccf63e1b349969487a0519ef205a73b01e7883d28b7405775d367a453963bf3593c1d2bf140a571569214657ff15e14d30015ae0be43686cdacda
- SSDEEP 3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ+:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIz
- TLSH T12B4413C2A6D95AF5ECC619771A23DF841F56FE3169C60910BA04B16F49F73C1AA13323
- MD5 SHA1 SHA512 SSDEEP TLSH