9cc24d28a44bb0fb3cebe34218e2df484a11031ce7c6701f2102034497933c8b

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 18:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Delf.yb.exe
Size 2.7MB
Sample261009-w1t82ats9q
SHA256 9cc24d28a44bb0fb3cebe34218e2df484a11031ce7c6701f2102034497933c8b
MD5 6850e59ba483cebfd02ee1b7439b1c85
SHA1 c3ad9b4492760ec113c0041a04793fafa8fcbfff
SHA512 ec2fa111ddc92f67a99074256df8d9b6194856b3f801ad66d817e0f37a9b5222adef0b3c7bf2a58f00bfc3262961ee3f672603700e52bf729275557ceb102a91
SSDEEP 49152:4ng5hkDXYQLXJ2rjc9pMiWFoifq3qvUyy2X9rc6CynIWaR6RFO2TspRA0d:4nihAPwoz0oifQOU3cdHtaR6RI2IRP
TLSH
T178D533079169957AE967CEB47E52D831023B7D2B8D2C972C078CDCDEAF270160A117DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jaffacakes118_Trojan-Dropper.Win32.Delf.yb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\UpdateManager = "C:\\Program Files\\Common Files\\Microsoft Shared\\Web Components\\WUpdMan32.exe"	jaffacakes118_Trojan-Dropper.Win32.Delf.yb.exe

Executes dropped EXE 7 IoCs

pid	Process
4716	TempInst.exe
1792	is-51P8A.tmp
3104	WWWFileSharePro.exe
3540	Installer.exe
5920	NTService.exe
2320	NTService.exe
5856	NTService.exe

Loads dropped DLL 13 IoCs

pid	Process
1792	is-51P8A.tmp
1792	is-51P8A.tmp
3104	WWWFileSharePro.exe
3104	WWWFileSharePro.exe
3104	WWWFileSharePro.exe
3540	Installer.exe
5920	NTService.exe
5920	NTService.exe
5920	NTService.exe
2320	NTService.exe
2320	NTService.exe
5856	NTService.exe
5856	NTService.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\SetupCleaner = "C:\\SetupCleaner.exe"	jaffacakes118_Trojan-Dropper.Win32.Delf.yb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\WWW File Share Pro = "C:\\Program Files (x86)\\WWW File Share Pro\\WWWFileSharePro.exe /1"	WWWFileSharePro.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\is-AVI8C.tmp	is-51P8A.tmp
File created	C:\Windows\SysWOW64\is-K51P1.tmp	is-51P8A.tmp
File created	C:\Windows\SysWOW64\is-1KLHH.tmp	is-51P8A.tmp
File created	C:\Windows\SysWOW64\is-2KV6C.tmp	is-51P8A.tmp

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5100-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral2/memory/5100-6-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WWW File Share Pro\is-E9AOF.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\is-FK7QQ.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\CaptureScreen\is-1OV66.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\SystemInfo\is-36GJR.tmp	is-51P8A.tmp
File created	C:\Program Files\Common Files\Microsoft Shared\VBA\TempInst.exe	jaffacakes118_Trojan-Dropper.Win32.Delf.yb.exe
File created	C:\Program Files (x86)\WWW File Share Pro\Root\is-HVGS9.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Root\is-ADDV0.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\is-8OJ8U.tmp	is-51P8A.tmp
File opened for modification	C:\Program Files (x86)\WWW File Share Pro\web.css	WWWFileSharePro.exe
File created	C:\Program Files (x86)\WWW File Share Pro\is-76MLC.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\Message\is-7SDVS.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\ShutdownReboot\is-F2PTU.tmp	is-51P8A.tmp
File opened for modification	C:\Program Files (x86)\WWW File Share Pro\fileshare.ini	WWWFileSharePro.exe
File created	C:\Program Files (x86)\WWW File Share Pro\is-Q38LS.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\Message\is-I6QMF.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\SystemInfo\is-NJESK.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Root\is-HB6ER.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\is-RPOLI.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\WAV\is-PIN12.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\Message\is-QUB99.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\ShutdownReboot\is-L402D.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\ShutdownReboot\is-I6KJU.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Root\is-DRH77.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Root\is-J75MG.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\WAV\is-2NB3O.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\RemoteDownload\is-QBPI0.tmp	is-51P8A.tmp
File opened for modification	C:\Program Files (x86)\WWW File Share Pro\WFS.url	is-51P8A.tmp
File opened for modification	C:\Program Files (x86)\WWW File Share Pro\Note.txt	WWWFileSharePro.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Web Components\WUpdMan32.exe	jaffacakes118_Trojan-Dropper.Win32.Delf.yb.exe
File created	C:\Program Files (x86)\WWW File Share Pro\Root\is-5PK0S.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\CaptureScreen\is-E8L66.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\Message\is-OIN8J.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\Webcam\is-N4018.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\user.pwd	WWWFileSharePro.exe
File opened for modification	C:\Program Files (x86)\WWW File Share Pro\Ban.ip	WWWFileSharePro.exe
File created	C:\Program Files (x86)\WWW File Share Pro\Root\is-ODEPU.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\Webcam\is-SM910.tmp	is-51P8A.tmp
File opened for modification	C:\Program Files (x86)\WWW File Share Pro\protection.cfg	WWWFileSharePro.exe
File created	C:\Program Files (x86)\WWW File Share Pro\WAV\is-R43JD.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\unins000.dat	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\is-9V63R.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\is-9771I.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\Webcam\is-A99MQ.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\dir.cfg	WWWFileSharePro.exe
File created	C:\Program Files (x86)\WWW File Share Pro\Root\is-TMEOL.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\WAV\is-3HPSP.tmp	is-51P8A.tmp
File opened for modification	C:\Program Files (x86)\WWW File Share Pro\unins000.dat	is-51P8A.tmp
File opened for modification	C:\Program Files (x86)\WWW File Share Pro\uploaduser.cfg	WWWFileSharePro.exe
File created	C:\Program Files (x86)\WWW File Share Pro\is-KBNRA.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\is-8NTM4.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\Message\is-NLKBE.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\Webcam\is-M5BO5.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\is-0JPHQ.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\is-RUUSP.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\is-FCI4U.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\is-G2NA8.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\is-RGRRU.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Root\is-6US4L.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\WAV\is-4QACU.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\RemoteDownload\is-J50AU.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\RemoteDownload\is-ES8JT.tmp	is-51P8A.tmp
File opened for modification	C:\Program Files (x86)\WWW File Share Pro\upload.dll	WWWFileSharePro.exe
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\Webcam\is-JQEP0.tmp	is-51P8A.tmp
File created	C:\Program Files (x86)\WWW File Share Pro\Plugins\Webcam\is-IFF2S.tmp	is-51P8A.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NTService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Delf.yb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	is-51P8A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NTService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NTService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WWWFileSharePro.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	WWWFileSharePro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E7BC34A3-BA86-11CF-84B1-CBC2DA68BF6C}	NTService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\VersionIndependentProgID\ = "COMCTL.TreeCtrl"	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\MiscStatus	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8626-0FB3-11CE-8747-524153480004}\ProxyStubClsid32	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8D1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	NTService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E7BC34A2-BA86-11CF-84B1-CBC2DA68BF6C}\TypeLib\Version = "1.0"	NTService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B7E6392-850A-101B-AFC0-4210102A8DA7}\1.3\0\win32	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E953-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D8B-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}\Version	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6B7E6392-850A-101B-AFC0-4210102A8DA7}\1.3\HELPDIR\ = "C:\\Windows\\system32"	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA52-E020-11CF-8E74-00A0C90F26F8}	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D83604-895E-11D0-B0A6-000000000000}\ = "IColumnHeader"	is-51P8A.tmp
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94444-E5E8-101B-B9B5-444553540000}	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62823C20-41A3-11CE-9E8B-0020AF039CA3}\ = "Button Property Page Object"	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E944-850A-101B-AFC0-4210102A8DA7}\TypeLib	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{373FF7F1-EB8B-11CD-8820-08002B2F4F5A}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EC0AB1C0-6CAB-11CF-8998-00AA00688B10}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Control	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A7-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7BC34A1-BA86-11CF-84B1-CBC2DA68BF6C}	NTService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ProgCtrl\CLSID	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A3-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83601-895E-11D0-B0A6-000000000000}\ProxyStubClsid32	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6E1B5150-DB62-11D0-A0D8-0080C7E7B78D}\TypeLib\Version = "1.3"	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D83603-895E-11D0-B0A6-000000000000}	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8}\ = "IColumnHeaders11"	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D95-9D6A-101B-AFC0-4210102A8DA7}	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\ProgID	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8A-9D6A-101B-AFC0-4210102A8DA7}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\TypeLib	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{248DD892-BB45-11CF-9ABC-0080C7E7B78D}	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA62-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\TypeLib	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D83601-895E-11D0-B0A6-000000000000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E791-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8AF-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D94-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.TabStrip\CLSID\ = "{9ED94440-E5E8-101B-B9B5-444553540000}"	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\MiscStatus\1\ = "131473"	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83601-895E-11D0-B0A6-000000000000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{248DD893-BB45-11CF-9ABC-0080C7E7B78D}\ProxyStubClsid32	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Programmable	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D8-850A-101B-AFC0-4210102A8DA7}	is-51P8A.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8D0-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8E-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	is-51P8A.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BF877894-E026-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	is-51P8A.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3104	WWWFileSharePro.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3104	WWWFileSharePro.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3104	WWWFileSharePro.exe
3540	Installer.exe
3104	WWWFileSharePro.exe
5920	NTService.exe
5920	NTService.exe
2320	NTService.exe
2320	NTService.exe
5856	NTService.exe
5856	NTService.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 4716	5100	jaffacakes118_Trojan-Dropper.Win32.Delf.yb.exe	90
PID 4716 wrote to memory of 1792	4716	TempInst.exe	91
PID 1792 wrote to memory of 3104	1792	is-51P8A.tmp	94
PID 3104 wrote to memory of 3540	3104	WWWFileSharePro.exe	95
PID 3104 wrote to memory of 5920	3104	WWWFileSharePro.exe	96
PID 3104 wrote to memory of 2320	3104	WWWFileSharePro.exe	97

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Delf.yb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Delf.yb.exe"
1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Program Files\Common Files\Microsoft Shared\VBA\TempInst.exe
  "C:\Program Files\Common Files\Microsoft Shared\VBA\TempInst.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Users\Admin\AppData\Local\Temp\is-5LSHN.tmp\is-51P8A.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-5LSHN.tmp\is-51P8A.tmp" /SL4 $500A8 "C:\Program Files\Common Files\Microsoft Shared\VBA\TempInst.exe" 2430129 51712
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Program Files (x86)\WWW File Share Pro\WWWFileSharePro.exe
      "C:\Program Files (x86)\WWW File Share Pro\WWWFileSharePro.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3104
    - - C:\Program Files (x86)\WWW File Share Pro\Installer.exe
        
        "C:\Program Files (x86)\WWW File Share Pro\Installer.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3540
    - - C:\Program Files (x86)\WWW File Share Pro\NTService.exe
        
        "C:\Program Files (x86)\WWW File Share Pro\NTService.exe" -uninstall
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:5920
    - - C:\Program Files (x86)\WWW File Share Pro\NTService.exe
        
        "C:\Program Files (x86)\WWW File Share Pro\NTService.exe" -install
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2320

C:\Program Files (x86)\WWW File Share Pro\NTService.exe
"C:\Program Files (x86)\WWW File Share Pro\NTService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Installer.exe

Path C:\Program Files (x86)\WWW File Share Pro\Installer.exe
Size 86KB
SHA256 0bd062eaa591a8558c3af245b594cdecfb9244865579a4a5824e733660179abd
MD5 5328c7f6c69cc7f6ce5267f2ff12b6bd
SHA1 1f4e26114ece9623820f1d68d956e85e5f94572e
SHA512 db477f8891450f521d500d7e89388d781fbf601d60babe9ecabf1457f5ab54e3f5761be8d291cc3f073a6c65250bd626b46e5c4326b44f32751b9c927de192d3
SSDEEP 1536:D4Vj/0WEnRCc43w1mRYkufuHM2TqbiZfGs5p7lmHl0BIm:D4hsq3w1meka2VJhuRm
TLSH
T110838D8E3FC9B42CE3D87BBA5F55B57593188CCADC23565A4862EE8370FC6035AB0409
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTService.exe

Path C:\Program Files (x86)\WWW File Share Pro\NTService.exe
Size 20KB
SHA256 37e5ac340ac39fafad96a922aef3cc42c38de50981edc63ceb1ec784dbc8ac7a
MD5 b0fc8d398b693cde1aca18965285a0e6
SHA1 caf8f4185db3541158a154da12d94002bec99741
SHA512 736d2510e7cdf78e646fcffc8e7b509e749b3dd1969c9a0837fb1e12ec01920ff375267c6b81a4999db54470ff327b87c3b9913300e08a30ce58f1c6e97e15a0
SSDEEP 384:uW61Paoh7V74akKYh2U3XZrD30sTEC14Hlkn:DEaon74D3xxQgn
TLSH
T130929337FAFD2162F25E91B61E3707B55D27FC302801925F5E80AE4CADB55589C60B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Note.txt

Path C:\Program Files (x86)\WWW File Share Pro\Note.txt
Size 285B
SHA256 35a66ebec884ea8ff9bba3615c235cc8f312e5dbdc6eb7db3c999e0b998c4fa3
MD5 61c7d5593c018af55364dac014945062
SHA1 07212cd32e37332e0accd76d235d80fc8013d50c
SHA512 086623ff3f829c30527fdb5e6bc617dd0251a0d2da8030462e81bd5e3503e60c111e1cadaf2d4fdeddd3a21240a9a8161c0638e3b6e619c25eec278d9033362a
TLSH
T1CFD0C2857BC0D71D5AC719069401A53896CBA8DDA203993C351428CBC91CB4489651E9
MD5 SHA1 SHA512 TLSH

Submit Download

setting.ini

Path C:\Program Files (x86)\WWW File Share Pro\Plugins\CaptureScreen\setting.ini
Size 117B
SHA256 eb991423fbfa0399c7296e37d76138b1bd1674b2bba8fed25319105942e6bd77
MD5 43703c319921486819a7ae17af23214c
SHA1 4073a44b40950037e194dde051bbb4e0e7b6eb85
SHA512 37d632c1801e2744e4b8479b53c66b04c32eaada21e6faff5ccdbada4a43c7f22f3c9c791e8bc911471ebb4fb6a1cf8d02486a371c25c7f00b9d46b5058f7117
TLSH
T1F1B0927A0EAA28C041209C569E0357DB8CB54898148E2213A1215A6A2A89841B378468
MD5 SHA1 SHA512 TLSH

Submit Download

setting.ini

Path C:\Program Files (x86)\WWW File Share Pro\Plugins\Message\setting.ini
Size 103B
SHA256 7c1e7ab58027f356bc9b7106a0e6f975b7e9a21aec0314aef80e006fbac07e23
MD5 d4dc1964d96a86670b77c1736e2825f1
SHA1 12bc0e6a1cb29105a05d539de8a96257cfb03dbd
SHA512 c1fd92d865a13e5c2fc1c922a4b8b154255fbf36c486aa6d8ce39b6d4f76dd6159d5781cea5c4472fc6b51d336ffd3215eb95c942fefb41fc93d5ef5d2ca33c3
TLSH
T193B012335CFC5CC5015054A87E40778B64855428054D3311E0351DCF77A1CC1413F7DC
MD5 SHA1 SHA512 TLSH

Submit Download

setting.ini

Path C:\Program Files (x86)\WWW File Share Pro\Plugins\RemoteDownload\setting.ini
Size 120B
SHA256 75c22136bacc199888560c7e94019cfc380459bcf8386cf84e0d9946ac80b3ad
MD5 4cc8b296782a97f3fc04e4090bbc7b0e
SHA1 f2e27d9dae708bc698b330f587a5660e8e3846d7
SHA512 92582128de919534c2bbda710abb28b14a4b55bac6d96d37bff607528549cdfa0af73dc41101cc68b33d837b4e41d8a86771ea230d26e79693a8fd0613d43514
TLSH
T16BB0922B58AEAD810110A4692A084AAB68E9549A054D1252A1315DCEEAA6851C12B4EE
MD5 SHA1 SHA512 TLSH

Submit Download

setting.ini

Path C:\Program Files (x86)\WWW File Share Pro\Plugins\ShutdownReboot\setting.ini
Size 119B
SHA256 73629e412eba009895879f1b479085a98a03c8ca9e50a0d8209f7773771cdb55
MD5 265fdfc5b745f6034f94b1d2fd22dc62
SHA1 d9226e2d68dc90302823406d546924d3d3dc920d
SHA512 68cc4e7218d27205763f944c8417e57eb017ea9e24502714b0de23f699c89c320254530c87ddb7427d704467b175dede2ccda5723b5772e32e2f619b55f093f1
TLSH
T190B092168CB92A810120B8EEDE01D68F64968899148F9251A0606ECF7BA2489C2BB4AC
MD5 SHA1 SHA512 TLSH

Submit Download

setting.ini

Path C:\Program Files (x86)\WWW File Share Pro\Plugins\SystemInfo\setting.ini
Size 107B
SHA256 6251d8b755d4f31df529fbbb757e3148696035d2800e219a36b9365916491a0d
MD5 f2d783505355edf8bb42826c9251e6aa
SHA1 edd7e8b3b33685adf631db22e2d48365accbb762
SHA512 6c64709f1b810e4f4e2f2dbee5a8ab58b39aed6f196dc7c4085f0d2ae6f95a960b5b95f1afd35f965e044ff6f5d77bca367f5045501944957c0654046af7284f
TLSH
T1E2B0123217FE5480911C685D3906EBBF4465C4AC318DD251A5A32D4F5B02B0DA3B809C
MD5 SHA1 SHA512 TLSH

Submit Download

setting.ini

Path C:\Program Files (x86)\WWW File Share Pro\Plugins\Webcam\setting.ini
Size 109B
SHA256 c04a289986e79e67b781da0a1daff670a2a543a9d76e9a100dc6fbec4147e19a
MD5 45a174f6690c8622739b5b5aac6e9dbe
SHA1 76177d07f524a99fca401f299a1ca2e2f9320565
SHA512 b5e8e428af924c514c12bb8dc6b9569830e97119ef3f9f965689e8ac5512f74be161c0337b74fe89569a9fa6652b23363392e24129ca5535768dc7301d394c0b
TLSH
T130B0922A98792883213168682E026ACB98888819584E4726A5201A4E261144192AA46C
MD5 SHA1 SHA512 TLSH

Submit Download

WFS.url

Path C:\Program Files (x86)\WWW File Share Pro\WFS.url
Size 48B
SHA256 7e6b23a9e86e5303a842d4dfa17fe6191ede16bfe505903b464760d519395d5f
MD5 b49ea10b15c27b20c6ab86ce07fc8782
SHA1 d281732b3903250f7209b411fa3a4e6584d57a55
SHA512 951d611e9d86bcd93cd2fca805c1f0d1079bd250df0030a47be76041cf9d9ba8a6de71224e976b4547687ac298f1e9b7b29b99d73e6ae5c675c72a652dd258c8
MD5 SHA1 SHA512

Submit Download

WWWFileSharePro.exe

Path C:\Program Files (x86)\WWW File Share Pro\WWWFileSharePro.exe
Size 226KB
SHA256 e900889067ceeeaf5ae8440c3c8da17d66a518a21cf1b42e45c3759580e77c0d
MD5 2c667d840db7a8cd4ff049898e998970
SHA1 a6c5cbb51e0ff9e2951313e0a6dd7fe68f62733f
SHA512 64417f56ea2a284178d51f57f8f24918e81949bf6e8b1aea69267e03082ac9d4779a99e0334ce9b1cd36aa4a0bc90183248d24d036de5359d59b60909dcc0fe9
SSDEEP 6144:9wBZ1TXsrzc/PnUPoKpCUJtHXtxTpt/3UGY:iIzgPnUgMjRTptvUGY
TLSH
T1663412D7BBD9B870C09557304423AFB22462ED9148117F0B97A9AF8D3D72331EC2796A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fileshare.ini

Path C:\Program Files (x86)\WWW File Share Pro\fileshare.ini
Size 468B
SHA256 ef486ee6adccd059e60fe960d413e87fadfcb6976fd45d60828a152fa50df73d
MD5 d4bd83a513bd1fda36139b946ace40f1
SHA1 588ba4a9bbc0af763de5d3f2d20b147a7fd7207b
SHA512 1e2a3551810312f28ffbbf105369e767ba55a509b69794197fba53911cdca56b57c3eb9bbd3118e861ab95bf0b2b3ffa2fc94002c72be6d7a53a32b437f0b0db
TLSH
T1EEF05C1CB80F5189043F91BA1DD3F56526572851504FA1A5B8F10117E865EAF348DCAD
MD5 SHA1 SHA512 TLSH

Submit Download

plugin.cfg

Path C:\Program Files (x86)\WWW File Share Pro\plugin.cfg
Size 80B
SHA256 ccfcca2c753f6364c056cfd1dd641615c8186c0dd381cdff753c5d7606f61486
MD5 9a1151661a3c488887e42cca59267342
SHA1 b2a58d51272a41059dbfb482af815279686a33b4
SHA512 9928c8d5172c93d50788accb1faa7a328382907cd9384ad40861cf80260304fd96e50424d5194be98dc3c4debfeb27bf6f946348f122329b4dc005db45a69231
TLSH
T1A8A0110338002C8200FC0002E8CECCEA30EE0B0008A8F00088BC2B028C00C00000E00C
MD5 SHA1 SHA512 TLSH

Submit Download

unins000.exe

Path C:\Program Files (x86)\WWW File Share Pro\unins000.exe
Size 625KB
SHA256 ae1f4988105fd984f3e9d2c6224802bedb9e312185127677f2acb5d9765b9c20
MD5 89df21766ed024183b4dafc51c5155d6
SHA1 0ed3ebfb2384d8437849880316ca0655522438e0
SHA512 d41fb7743c759f9928a5a23686bff47d2be13dec33b09669cf90e37ff39979ac5283cf137c08429d17ff8511845ccd43f20a9735326bcc013bdf948a7fdb90bd
SSDEEP 12288:6tOokrvhfrPY37nzHNA6iA1D2ftCy7ONbzw32AreMAZZ9xpr:Bo0vhfrPY37nzHNA6iA+74seMAZvxpr
TLSH
T189D46B23F2909437D1B31E789D5B86D4982AFD102F34A4A676E81F4C4F396917A2B3D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upload.dll

Path C:\Program Files (x86)\WWW File Share Pro\upload.dll
Size 14KB
SHA256 9291a1c6b8745dd568867ab6db7ccb82d63f89a4555cf16d5b90c61ddc7ba614
MD5 502188ea70fed517c68d6f007f2c0250
SHA1 5cf68a0b161bb141c863ac9a412223e6564b85be
SHA512 f73b49b2a018b05d5b1140812afa46c8365ef4d59d2f72441fa0024424a87d051fd340b0315aaffa60726c5be6ef2ee82364eac0c994508fc4da4b1827b7043a
SSDEEP 192:zuORMW3VDJOEMXctz2UMDAvFcJg+2ASyfoDDP4QouBcH7t9:CO1lyMtz/ZiJiNDP4QoOcH7t
TLSH
T1ED52A33672EFC53BE98E02F60D6692DD24627F54CF40D1173A8ABF0E1F35980952062B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upload.dll

Path C:\Program Files (x86)\WWW File Share Pro\upload.dll
Size 14KB
SHA256 a8d8a6331407d811b15090e61df2153f98e2250d0e3c51633b93c4ec1f000482
MD5 c3143227f4a35dadac613ea44a47f9bc
SHA1 ce64530704e57c0f2a672c19b5abf53978e9766f
SHA512 3f2337db278ee985ba5c6123a5b5adda4db820db95c35c109f5bb09fda1ce15f707cafdcc9a13f7ca5719e67d2b4e63cd4d5ba56afa3d5e972758ec2923b8098
SSDEEP 192:zuORMW3VDJOEMXctz2UMDAvFcJg+2A6yfoDDP4QouBcH7t9:CO1lyMtz/ZiJKNDP4QoOcH7t
TLSH
T16852A33672EFC57BE98E02F60D6682DD24667F54CF01D1173A8ABF0E1F35981952062B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

web.css

Path C:\Program Files (x86)\WWW File Share Pro\web.css
Size 245B
SHA256 4928682cfc53b5962c4fe864ef7bad3d469eab6ace7d6a3ceea312243960db9f
MD5 cf2b71df2c73fdfebc1e34da447e798e
SHA1 5104f587794df40be49de4b71b6132618786e002
SHA512 a9cb51de60175f4bb311ae8c43b6bc30a6caea80dc301839e647064c77746de25ed32411178eb21a4b65e843cb2d2be3e76fcdfdd00da95318afdeefee8fe5a3
TLSH
T1E5D02E82840DA782A52B883B7081E3A0483072C4ECB39320B6F205E8CD098123313B0E
MD5 SHA1 SHA512 TLSH

Submit Download

wfsp.chm

Path C:\Program Files (x86)\WWW File Share Pro\wfsp.chm
Size 600KB
SHA256 201c646eeacf462293da3c4c50a957262615356bc06091702abe934fbb1cc71e
MD5 3c34dc80097c48876bbdf3af9c3251ab
SHA1 1b9340d89b0e55f8d715ff88081fede645a549b3
SHA512 536a75982545e7594507aacdf264550dc6e1e3dc59c02c6ffa90f1578b1320e701fbeee6adf323e059b2107a200c706c77298891d76f84f51f752559045ccd41
SSDEEP 12288:uubbyJIwCpEUJT2XaypyHz3khjWruxvgYWJRQ3G4plsk5Ee+v:DWLCp1JUHpyHTkNWrygY64plsxe+v
TLSH
T194D433265E8F1853F2CC52BE9407FC91BE44A95D6492D3F0BC7D2850C7EAFCA85602E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TempInst.exe

Path C:\Program Files\Common Files\microsoft shared\VBA\TempInst.exe
Size 2.5MB
SHA256 4dfc7de44f415f5480411dbd72adbf23b7569774384841cca7530f7b4a720d42
MD5 081779395ac1177b059b2041532e63e0
SHA1 8f1b32ba4cff6e8264fc529f993ced92e88bc265
SHA512 3a7d67ba7a08401bc1ffc1a99af37601cf7049aed7b05aa391f1f6325ebdacbe542fd3676cc8187574907d6ecdee4498eed0d4c7beecb1e732a8ea05ab3b534d
SSDEEP 49152:MhkDXYQLXJ2rjc9pMiWFoifq3qvUyy2X9rc6CynIWaR6RFO2TspRA0E:MhAPwoz0oifQOU3cdHtaR6RI2IRq
TLSH
T12CC5330791A99576F566CEB87E22D841123B7D3B8C3C922807CDDCDAEF3B0164A5271B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-51P8A.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-5LSHN.tmp\is-51P8A.tmp
Size 616KB
SHA256 d3f6c4e1b8e6d11661d4bdf79b438382bb5951e7a42cedbcac3ebbe88012373c
MD5 0e5fd0fc130e2380b08edca8f822f382
SHA1 e36aacde42ac8f297d3bffb379c021639ef4c06a
SHA512 efaabebb37413eb2a689be4070827dbeb9ba8f88f6a90a3ed33225c68eb02e43e4760dcfdf3e59eba589db0519e9ac447035ef9b3822c0414ccebdc79a5bde37
SSDEEP 12288:CtOokrvhfrPY37nzHNA6iA1D2ftCy7ONbzw32AreMAZZ9xp:po0vhfrPY37nzHNA6iA+74seMAZvxp
TLSH
T14BD45B32F2909437D1B31E749D5B86D4982AFD102F34A4AB76E81F4C4F396917A2B3D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Comctl32.ocx

Path C:\Windows\SysWOW64\Comctl32.ocx
Size 594KB
SHA256 bf4147f8a12bec3d54e3ef941475e29d852a1876117c6ce88f47b882ef6d4a03
MD5 eb5f811c1f78005b3c147599a0cccf51
SHA1 19e8153569d1379634ba9d12e84dc35b10faf689
SHA512 2eeed9e02c2fbff39c021340a8fa10417a47e243ae2d6d5a54e3e69114dccb402f2d836500c6d771ff971cf0070def3004f3e828a9e7686ef0e1457e1583ecec
SSDEEP 12288:0kec4KwGf99MSOeMkeXrnhIcVthDGn2mwCyP9tDCcrcJIVul+:0k6nTSXJI4l+
TLSH
T114D43A02F7D69122E8B61D30897B5BB22B727C557D35D21F2384777E1C72B81AE22326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVBVM50.DLL

Path C:\Windows\SysWOW64\MSVBVM50.DLL
Size 1.3MB
SHA256 8611dc1b60ae5c383bba6cb3ffd8a51aeebff23b95844f0ab3d6e5ecd0fadc84
MD5 157b3267a46a79dd900104f241da8c4c
SHA1 178271eaf8c48384e206cbaebcbbc12030980410
SHA512 acb496d811386c98ac67664ce9aeda86e49309e45430a4b66bd8433030afd0eab87ddabfda60b5bfbbfa2c84c118f89a5e636de7d0280c668a1c85bb5cbf7fff
SSDEEP 24576:1OYgy5FNbLxbKtz6PIYTccJf2Ak0q+o82Ngdqr2Q7N1wo+AYOHu/Ek5:ZVHNJf2AU3NxjN1wo+QO/5
TLSH
T16C556C53B3C08167CBE655340617773B76797D24AA25B94B6BE03A3E29323011B3BB36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mswinsck.ocx

Path C:\Windows\SysWOW64\Mswinsck.ocx
Size 105KB
SHA256 bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5
MD5 9484c04258830aa3c2f2a70eb041414c
SHA1 b242a4fb0e9dcf14cb51dc36027baff9a79cb823
SHA512 9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0
SSDEEP 3072:R7ZSBYfkVoFdRrqo0aRaA/HF673+UWHIfrb:RNkVsuaRaU6mHGb
TLSH
T1A8B35C02B3E58171E5F22B300A361B61AFBEBD25AD31864BC354765D1E31B95EE3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NTSVC.OCX

Path C:\Windows\SysWOW64\NTSVC.OCX
Size 44KB
SHA256 1e9ffb1a7e8963dc264264f79a76a4ef83ab60a9c0b13b07ebf48d8243156d73
MD5 9df2c14e284286c806be342f039335cc
SHA1 157b6309ab86bf63f69da85a82868651ad813458
SHA512 526bfa2aca222bc288982f2b2fdd65f41c047c488688a0dcced57265416532b1170605a80acfab36547c2edebb36d0f4bde677adab2130b3f1498b330d53a00f
SSDEEP 768:Q8v9EOgPPc6ToGIQIVcaALoESNphlI+iRZ9D:QCjgPU6ToJfVKoESrhWFRZ9
TLSH
T18013B501F7C148B7CB0A12342C5B67B692B5AC526FD197972FA8FF1D2C726D36B22244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1792-25-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1792-217-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1792-27-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1792-22-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1792-17-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/1792-16-0x0000000000400000-0x00000000004A8000-memory.dmp

Download

memory/3104-283-0x0000000000400000-0x0000000000508000-memory.dmp

Download

memory/3104-215-0x0000000000400000-0x0000000000508000-memory.dmp

Download

memory/3104-271-0x00000000064F0000-0x00000000065E9000-memory.dmp

Download

memory/3104-270-0x0000000006250000-0x00000000064E2000-memory.dmp

Download

memory/3104-268-0x0000000000400000-0x0000000000508000-memory.dmp

Download

memory/3540-240-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/3540-273-0x0000000000400000-0x0000000000448000-memory.dmp

Download

memory/4716-8-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4716-10-0x000000000040C000-0x000000000040D000-memory.dmp

Download

memory/4716-21-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/4716-218-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/5100-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/5100-6-0x0000000000400000-0x0000000000421000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads