Analysis
- max time kernel
148s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/10/2026, 17:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe
- Size 172KB
- Sample261009-v1237shx6k
- SHA256 f889bbab47a92f9ca39d0153ac0d71b915cb7af3cd7ed7c435aac2f3df5974ad
- MD5 fa26e07facf6bb0f59a53ec32fb461fc
- SHA1 d063d59efc950c162ac82e10a7cca88e37366200
- SHA512 11d2c2841b7c10203cde42ff3c700850fe7b7e7367ef4248557e5ace109e39828f086323ccfae7dc45216df626097ee1b7457f904de6f856eca4bf8c18925e2e
- SSDEEP 3072:ggOJxjzXJ6hQ2mGLjXHRfUTx7CQKY2u3LTcxIegwG6fFP4OP:lOJxjzXJt2BLREx2wU9y6XP
- TLSH T1E50402237C700CABD566CAF60E8825BEDB7F683A1F5091D7DF200BBD0D266D14E2419A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2320 pokapoka78.exe 1372 pokapoka78.exe - Loads dropped DLL 5 IoCs
pid Process 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System service78 = "C:\\Windows\\etb\\pokapoka78.exe" pokapoka78.exe - Drops file in Windows directory 46 IoCs
description ioc Process File opened for modification C:\Windows\PK-48577573-43567-43F-1234-465675346BOF_V65 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\etb\etb.ini pokapoka78.exe File created C:\Windows\PK-44358439df_V72 pokapoka78.exe File created C:\Windows\PK-48273ud832_V71 pokapoka78.exe File created C:\Windows\PK-48577573-43543-43F-FDCD-465675346BOB_V64 pokapoka78.exe File created C:\Windows\PK-48577573-4gfdg-4fdgdgfdfdg5fdgfdgfdgg_V68 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\PK-48577573-43567-43F-1234-465675346BOF_V65 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\PK-4laalalalalalgdgfdfdg5fdgfdgfdgg_V70 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\PK-48577573-47878-43F-2345-4654654654654_V66 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\PK-45967439-43543-43F-FDCD-465675346BOB_V63 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\PK-48577573-43567-43F-1234-465675346BOF_V65 pokapoka78.exe File created C:\Windows\PK-45967439-43543-43F-FDCD-465675345BOB_V61 pokapoka78.exe File created C:\Windows\PK-48577573-47878-43F-2345-4654654654654_V66 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\PK-443fdghdf3_V77 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\PK-48577573-43543-43F-FDCD-465675346BOB_V64 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\PK-4laasfgdgd4fdgdgfdfdg5fdgfdgfdgg_V69 pokapoka78.exe File created C:\Windows\PK-48577573-4gfdg-435564654-45654dfg-fgg_V67 pokapoka78.exe File created C:\Windows\PK-4laalalalalalgdgfdfdg5fdgfdgfdgg_V70 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\PK-4laasfgdgd4fdgdgfdfdg5fdgfdgfdgg_V69 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\PK-48577573-4gfdg-435564654-45654dfg-fgg_V67 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\PK-48273ud832_V71 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\etb\etb.ini jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\PK-48577573-47878-43F-2345-4654654654654_V66 pokapoka78.exe File created C:\Windows\PK-48273ud832_V71 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\PK-45967439-43543-43F-FDCD-465675346BOB_V63 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\PK-443fdghdf3_V78 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\PK-4laasfgdgd4fdgdgfdfdg5fdgfdgfdgg_V69 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\PK-48577573-4gfdg-4fdgdgfdfdg5fdgfdgfdgg_V68 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\PK-48577573-4gfdg-435564654-45654dfg-fgg_V67 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\etb\etb.ini pokapoka78.exe File created C:\Windows\PK-48577573-4gfdg-4fdgdgfdfdg5fdgfdgfdgg_V68 pokapoka78.exe File created C:\Windows\PK-443fdghdf3_V77 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\PK-45967439-43543-43F-FDCD-465675346BOB_V63 pokapoka78.exe File created C:\Windows\PK-45967439-43543-43F-FDCD-465675345BOB_V62 pokapoka78.exe File created C:\Windows\PK-48577573-43543-43F-FDCD-465675346BOB_V64 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\PK-45967439-43543-43F-FDCD-465675345BOB_V62 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\PK-45967439-43543-43F-FDCD-465675345BOB_V61 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\PK-45967439-43543-43F-FDCD-465675345BOB_V61 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\etb\pokapoka78.exe jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\PK-443fdghdf3_V77 pokapoka78.exe File created C:\Windows\PK-4laalalalalalgdgfdfdg5fdgfdgfdgg_V70 pokapoka78.exe File created C:\Windows\PK-443fdghdf3_V78 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\PK-44358439df_V72 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File created C:\Windows\etb\nt_hide78.dll pokapoka78.exe File opened for modification C:\Windows\PK-45967439-43543-43F-FDCD-465675345BOB_V62 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe File opened for modification C:\Windows\PK-44358439df_V72 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4256 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4184 2320 WerFault.exe 91 - System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pokapoka78.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ielowutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff5800000058000000de040000bd020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffae020000040100003407000069030000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffc80200001e0100004e07000083030000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2965879104" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffda000000da000000600500003f030000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff6800000068000000ee040000cd020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283219" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff900100009001000016060000f5030000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283219" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2853688388" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff7a020000d00000000007000035030000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff1e0100001e010000a405000083030000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff3801000038010000be0500009d030000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffbe020000040100004407000069030000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff7601000076010000fc050000db030000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff820000008200000008050000e7020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283219" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283219" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffba010000000000004006000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2894717556" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffe202000038010000680700009d030000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff1a0000001a000000a00400007f020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff4e0000004e000000d4040000b3020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff70020000b6000000f60600001b030000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff8a020000d00000001007000035030000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000fffffffffffffffffffffffffffffffff4000000f40000007a05000059030000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c5640e399963824c932d398a4058a4d800000000020000000000106600000001000020000000155b78f79a1885571a439259e9a98013dbdccdbf13c8efdd2cab204fc18a1fc1000000000e8000000002000020000000c40e63f603406afbd56f301b1ef2a55700c37c8f8c47809e0c27414e1d4a5723100000007aded2e86b320d6ed10a01275873d78f400000008c5cd26e5bcdfbc3f2f8c57e2a2b0ec8b89dc1947cd96fa1abe0de0280a9c24902a291bf7692299b17ca064f9ae16221bb556cfb96cea3884ccba952bfc83686 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283219" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2806986931" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2834774502" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes\Version = "5" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2814573121" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2841299413" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff04010000040100008a05000069030000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffffaa010000000000003006000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2202000068000000a8060000cd020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Recovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c5640e399963824c932d398a4058a4d800000000020000000000106600000001000020000000e77f34189121be2592ffaffe15d93497b75b02ad77044641f52808efd8fa1945000000000e80000000020000200000002346df1819169f0b2c266318358c0a71d9b1bcaf56c91b861e544d9a6529a2af50000000c1952374f2e6228b1061ee93af9976611205ef1067df9a8dba09472168f47d4b61e8677aae6439136287d1c12519b1ef739bb948a24176dc89ee661957ff76c6d631e6e0750ab432ce4f0e6f4df6336d40000000ab7bfe04499351a5dfb2b087aa2831541d02ae9aa4b0ffa92c1927db59cd103b68486cdddcfd58fc80c9f6ee4feb78916f3464a0e308e782838275a75a19dfb0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2858055773" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283219" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff560200009c000000dc06000001030000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c5640e399963824c932d398a4058a4d800000000020000000000106600000001000020000000ff0de3aa761d13e9c036cae898deb720f344c4ca793fc1db84fbb8ea800527c5000000000e80000000020000200000003f3cdc367086e4090ffd3509a69d2d63f8d550d655a69bcdcf82d872e442fed6100000008280bc9b7313ebe8abbb70596ace6af340000000550dd6d0340f95c6569febdbd8f20050f744e1fc35f0969a4c3e4e76b6460997b3a8d5e09afaf43bd19882abd587fe105a54b82876cc8ff89a1705755de4e898 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000fffffffffffffffffffffffffffffffff80100004e0000007e060000b3020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe 2320 pokapoka78.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2320 pokapoka78.exe - Suspicious use of FindShellTrayWindow 57 IoCs
pid Process 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe 2488 iexplore.exe - Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 2488 iexplore.exe 2488 iexplore.exe 4608 IEXPLORE.EXE 4608 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe 2320 pokapoka78.exe 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe 712 IEXPLORE.EXE 712 IEXPLORE.EXE 2320 pokapoka78.exe 2488 iexplore.exe 2488 iexplore.exe 1616 IEXPLORE.EXE 1616 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe 4344 IEXPLORE.EXE 4344 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe 712 IEXPLORE.EXE 712 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe 4668 IEXPLORE.EXE 4668 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe 1616 IEXPLORE.EXE 1616 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe 1292 IEXPLORE.EXE 1292 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe 4344 IEXPLORE.EXE 4344 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe 8 IEXPLORE.EXE 8 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe 4668 IEXPLORE.EXE 4668 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe 896 IEXPLORE.EXE 896 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe 1292 IEXPLORE.EXE 1292 IEXPLORE.EXE 2488 iexplore.exe 2488 iexplore.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 5640 wrote to memory of 2320 5640 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe 91 PID 5640 wrote to memory of 4256 5640 jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe 92 PID 2488 wrote to memory of 4608 2488 iexplore.exe 98 PID 2488 wrote to memory of 2692 2488 iexplore.exe 99 PID 2488 wrote to memory of 712 2488 iexplore.exe 100 PID 2488 wrote to memory of 1616 2488 iexplore.exe 101 PID 2488 wrote to memory of 4344 2488 iexplore.exe 102 PID 2488 wrote to memory of 4668 2488 iexplore.exe 103 PID 2488 wrote to memory of 1292 2488 iexplore.exe 104 PID 2488 wrote to memory of 8 2488 iexplore.exe 105 PID 2488 wrote to memory of 896 2488 iexplore.exe 106 PID 2488 wrote to memory of 2508 2488 iexplore.exe 107 PID 2488 wrote to memory of 1580 2488 iexplore.exe 108 PID 2488 wrote to memory of 52 2488 iexplore.exe 110 PID 2488 wrote to memory of 3280 2488 iexplore.exe 111 PID 2488 wrote to memory of 5584 2488 iexplore.exe 112 PID 2488 wrote to memory of 1500 2488 iexplore.exe 113 PID 2488 wrote to memory of 2368 2488 iexplore.exe 114 PID 2488 wrote to memory of 3204 2488 iexplore.exe 116 PID 2488 wrote to memory of 4652 2488 iexplore.exe 117 PID 2488 wrote to memory of 2928 2488 iexplore.exe 118 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.za.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\etb\pokapoka78.exeC:\Windows\etb\pokapoka78.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2320 -s 12723⤵
- Program crash
PID:4184
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c c:\temp.bat2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4256
-
-
C:\Program Files (x86)\Internet Explorer\ielowutil.exe"C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding1⤵
- System Location Discovery: System Language Discovery
PID:5408
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:17410 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4608
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:82948 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2692
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:17414 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:712
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:82952 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1616
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:17420 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4344
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:82960 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4668
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:17428 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1292
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:82968 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:8
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:17436 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:896
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:82976 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2508
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:17446 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1580
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:82988 /prefetch:22⤵
- System Location Discovery: System Language Discovery
PID:52
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:17458 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:3280
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:83000 /prefetch:22⤵
- System Location Discovery: System Language Discovery
PID:5584
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:17470 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:1500
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:83014 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
PID:2368
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "2488" "9108" "9100" "9132" "0" "0" "9144" "9116" "0" "0" "0" "0"2⤵PID:3204
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "2488" "9136" "8996" "9128" "0" "0" "9144" "9080" "0" "0" "0" "0"2⤵PID:4652
-
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "2488" "9128" "9060" "9144" "0" "0" "8996" "9080" "0" "0" "0" "0"2⤵PID:2928
-
-
C:\Windows\etb\pokapoka78.exeC:\Windows\etb\pokapoka78.exe1⤵
- Executes dropped EXE
PID:1372
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5488
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 2320 -ip 23201⤵PID:4044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.ba92004c-a851-4830-95e6-d919096403d4.tmp.WERInternalMetadata.xml
- Size 9KB
- SHA256 7c3bd065ee43fa3a848f38acf6795e6f412bef628bb7f63171d73148bc59ad92
- MD5 51a38c36c88401ec49c5b6e0f35d5569
- SHA1 0ee3b9c6b87b2efbbc0e8cd6845e5da5c99aaa1a
- SHA512 f55855aad15b6b05198294faba2855714a6f639db62bd8c9636d55e3647bb2539c6dc436cf09316350131281dce69e594ab3e55d3161b4838a1c28655baee0f8
- SSDEEP 192:R/y7wSNzawaMl9aME9aMt9CMOD9A9qaMt9CMOD9A9Ea43boFf6YbP5gmf8UQMfNH:R/yTNzawaMl9aME9aM3CMgKqaM3CMgKP
- TLSH T16222CF6757EA0219F1F7EE54ABF440761766BC532E1DCC3C00A4060D88B3AA1F5A1FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 471B
- SHA256 0358c3bf535535f06d1fab34399bcba2f546d271fc13634c3ec363a27e6b56af
- MD5 dacc3f844934847c327440efed9d15a6
- SHA1 4f8bde193fd979bc59c666767d56480fec2106d3
- SHA512 9f691e32b7f9219f1c9410cecbce993d60c351bd1b23528145a28119f98e84d5e615bff2adc21c24945ef105fb504046725159212c02cb5679d0c34681137643
- TLSH T1C8F0548994E6F7E1DF81C8EC03B4459F342090A646555285317C45F1404535FFE1F0B5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
- Size 342B
- SHA256 7cbae59401792d3ed1fa7f38390cd681e7e522321b31421a2011e98b7e1a80d1
- MD5 748ee4c6bb81fa3940c46ee61d93444d
- SHA1 4ebd3d631893a4114ccc133da08097dacf504e8b
- SHA512 fb4166de242e7cbd30a64300b49da97a0fafd3b3dcc4733939ec09306edc1711c7c95909a193a3e535be7810211e2c84c219183fa00d2e8f4c771bc7eb2fa348
- TLSH T194E0C7123FA81204E9330A3CA973A4899976B3ABAE01CACD0774018D0D24FA28932719
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
- Size 416B
- SHA256 bfc78ae2392ce9203ce1351ad9ad71bbd4c5e1a8c40934c4ae4c13b8cb629a40
- MD5 a73fce5d8252d9a001e4f6ffad7f1589
- SHA1 82959f3aad7a6bd9f4ab572d698a09fd7cdc56a1
- SHA512 88d814d3b864a732b1a8a6bbc7948f55c46dc16fea2a90fc889247daa8ebc2249b6c20986b0a346d6d35e1a25bd2a080707a02dd5786d51e9505656aaea25fb0
- TLSH T186E0202411F6415FE5F4E47A47D5743595AAF1261529A3BC3ED89B08E702640FC03925
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
- Size 4KB
- SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
- MD5 da597791be3b6e732f0bc8b20e38ee62
- SHA1 1125c45d285c360542027d7554a5c442288974de
- SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
- SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
- TLSH T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MW9UJA6Z\known_providers_download_v1[1].xml
- Size 88KB
- SHA256 1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
- MD5 002d5646771d31d1e7c57990cc020150
- SHA1 a28ec731f9106c252f313cca349a68ef94ee3de9
- SHA512 689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6
- SSDEEP 1536:V5JGkeov2IRdGjYQ4OozRuTah6gK8wd1ObAto2cTReH5xCVYiA4Pjqcawh7O6GAn:R
- TLSH T165937D2A04C76881B231D8193DA87FC1DC30886BB4069AE57DFD471B8F79E4BA46367C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WLCSD876\suggestions[1].en-US
- Size 17KB
- SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
- MD5 5a34cb996293fde2cb7a4ac89587393a
- SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
- SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
- SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
- TLSH T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\328300_2320_2320_4472_78.41.tmp
- Size 87KB
- SHA256 0d03cf283d032dd0b7c7528000efaef89a7cc86ce5652f8399b629086b7e9645
- MD5 0f9b05f5ef457dd9d533d8716e5c2625
- SHA1 61c4ff1ed88794466f79d075bf782bbcec03b370
- SHA512 9adff0a0e0342ba8aac78ece7e47ee06f25928f3f9b46b9ecbd86454fee70cf05a885c46d4ab9f998292b017f8a9f62e54d74006b26c0ccb197729f7bbce495e
- SSDEEP 1536:FGD56qduBap/QWYHo/e+XoBV+isFZGs1UblvOY4304rxa4VaPGJpjnbzPc2CFEqe:00qcMpIWY3+4BFscQY0hx1VS8zbzBmte
- TLSH T18993029472D16C51DA78CDF04382AC1F8D0764BFAEE1DAE684704E21F596F604A6CBC7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\721126_2488_2320_4140_78.41.tmp1
- Size 5KB
- SHA256 57c712f1b1ad948f4bb2a13ae25e2be9d772f37d8ef9cc1513ddd4435f6efb19
- MD5 59db15bad55daf58c2396049b9d3ce98
- SHA1 cc119b0a94999ae85668229f27126fd1941f5522
- SHA512 3924a1f495ca3fdf887025f6392545048277f17d42c3c7f39adcb7f5fe17b8f44e093541d67beffd3bc3b88622f969a892a92b4c549b3c63faf562dd0e6260a3
- SSDEEP 48:CmwSp5+0LdAihOdQd+onS/y1M8PdijsJtoa6pqtUwdn1/zQHntx3Vo/4+boCQNya:vwOwPTEBQf0U81/MHHJ+boxyGk2uB
- TLSH T1F2C14A579B139CBBD84427B00686919CF27B35A14362A4F163A0085E5DF626839AAB82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\k_78A1.tmp
- Size 20KB
- SHA256 b7b7c081c5af7b4e82fddb225dd0e72140c93acbe0d071f682b088cca8bbfd21
- MD5 d4fdafc5b9182eb8e49d4425c56dd1cc
- SHA1 5bedd2dade05ee9249e04d1869223b01c11c0eb3
- SHA512 ba94d98f211c1ac85c774c06b3e9ff67f46a9cde63a544e23cb094bedc1986dcf1e3ec42336bd97d48fd187edf3f421c736efcbc4584a26eda53f03178a270ea
- SSDEEP 24:eNGSdY9r6Y9uA0APUaP/xDAVDHKRftFU4N87DMEPm4E7DMEfOXH0j9njph0pYjvf:adY9riAJJPS0tN8Xve4EXvWkjpphFxD
- TLSH T1679230776AA2B9B2E0580773019754E3A9B69F3077E8602CC69741459821A2BEE3CE47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\PK-48273ud832_V71
- Size 1B
- SHA256 2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881
- MD5 9dd4e461268c8034f5c8564e155c67a6
- SHA1 11f6ad8ec52a2984abaafd7c3b516503785c2072
- SHA512 a4abd4448c49562d828115d13a1fccea927f52b4d5459297f8b43e42da89238bc13626e43dcb38ddb082488927ec904fb42057443983e88585179d50551afe62
- MD5 SHA1 SHA512
- Path C:\Windows\etb\etb.ini
- Size 55B
- SHA256 36d771afcdd8cbb5461ef6d7d4bc0ab7fbadf9573ce827d877527e1565560a52
- MD5 22ac56cbf84af65deb691b44637e8693
- SHA1 54d4a9d19f384c520a67a3a73bfdd8d544bc70e4
- SHA512 a2fe4e9b10be0589ef1497a4c0febfe1a9fda22db39778dcb047da5e8ba663661f4ab99c16f9a1ec9f382946feb79bc82c8cf483235628b8c1b76880741e8083
- TLSH T1039002C44C44641214012D549416C58563F461029946944854D41041962719DD9B4142
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\etb\etb.ini
- Size 33B
- SHA256 e622964605389eb09291258312636a6588b0bf80a4e1b4e5706f40d91b8b651b
- MD5 ed7aeb2b165a5a46e26cd3a9ae3910f2
- SHA1 98dad5be2033158fb629949466640a4c6290f9e0
- SHA512 9f08a0734c873d66b02fa952920da2d09aac39924c1a875f1abf07714ba4f556dc02aca191ffc7b1d33b773112f1b936dc30fa293dfae079a3dd64be9344be31
- MD5 SHA1 SHA512
- Path C:\Windows\etb\etb.ini
- Size 38B
- SHA256 319e631240cc9bd366de7ca64caece5da41409a3af7a74735d5eb6ea2c82c54f
- MD5 060bbd22d6d444e3f2fbe40138b0fa86
- SHA1 57179b973a250b7bd6723f417f9cd006172f2a75
- SHA512 44c97ec2e557849d42105d846add7cb4e4d9ac0e29e61d4f7a48055556c5bd13312d470dacb8b293bc866f82888f7d6648bff0d43609785e7545f0ad1e5eea19
- MD5 SHA1 SHA512
- Path C:\Windows\etb\nt_hide78.dll
- Size 48KB
- SHA256 be945b1d2d77051e6703777baa77f0bc77079c30c16132cbe909ed0f505062bd
- MD5 7549cef6102b43d8d1803413b55d6fea
- SHA1 5d2d8aed2228b9a483b2374e09f70632ce87ec07
- SHA512 835335f695f9a42b53e4479a109dab00562a27a494aa3c3b4bb25e7b7bcebd47c372c4a3b209556842df6ab6b8748944fb02c946b83f8a79936b92c77eaa0aa6
- SSDEEP 768:qvJIRCYspPDIgIpEkK9C9FdPh97/fDYJwhjKp4Tz3+hs:qvCRJspPcbgWdpJUJwyhs
- TLSH T187232A01799040BDE7AF457569382B3D82B6B5342BC0A5D3AF822ADB4F233F1D4351AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\etb\pokapoka78.exe
- Size 136KB
- SHA256 9c3903562c6754059fdde9d3efe30b0862ee7eb1828a58263cfcc09932ad78ea
- MD5 89db56243c1ee9c973ee9e7faec3a356
- SHA1 140ec140444ca3984d1113092c773755ac11dbf1
- SHA512 655fbf70bd8dfb49fb34be99ec114b59cd47e68fc7781410013cb537eed5c8a57f50926d31bbb168705405f2a9c044d808874bc5b8e9531578929d6f338a0dc0
- SSDEEP 3072:YJ6hQ2mGLjXHRfUTx7CQKY2u3LTcxIegwG6fFP4O:YJt2BLREx2wU9y6X
- TLSH T143D312327C942EDFD9EADAFC05C860FF956E6C7E1698A0F2DE320A7E185755002990C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\temp.bat
- Size 223B
- SHA256 2bea2e96d128e82e957cb8fe56c0134fc4f49c86e9d621d56ce5ce8b15f6af10
- MD5 ff2992dace6bab3a2d57bd835d4bf247
- SHA1 9b96932fa423c599a5bbca984fb526afd72d864f
- SHA512 e1c00b0e338fb22784a23695f3bcb6b2daf7d9e7621b53cc2601a270a2833b2f778464d987d8152184653997c562599d1bed82545469a1cf155131503f033034
- TLSH T18AD0A70C039289050848CC3B95B14ACF90318A9C3A493F153370C088617009F62E731C
- MD5 SHA1 SHA512 TLSH