27fa51ad4a0e4399f0709745d91a82690c75f55ebe5b77d9d3e925d1f17910d8

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.StartPage.ajg.exe
Size 7.4MB
Sample261009-y239faes2w
SHA256 27fa51ad4a0e4399f0709745d91a82690c75f55ebe5b77d9d3e925d1f17910d8
MD5 775e8875532a6ac028de3046a5a75c9a
SHA1 cecfcd9f40abd0b31705f9e14c409ef87a69dc23
SHA512 87a0d65feee66f2cd5aa781f0c3d914b2e3f79bf6f7f8332f5a94f249c7fc1e50d386ccb609840b2524fc3322e220265cf19d77fa585355313e21dc2678036cf
SSDEEP 196608:Z6h4rK4mCz2lI5BbybqIQGld8cDdpXWQ7:MSmCyywqSXh7
TLSH
T1D27633789BA1D996C06256B441EB2784F93EFF348620CDEB689C36130CD7FF59C12A94
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3252	resgfvr.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\D:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\D:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 5 IoCs

execution

Visual Basic

T1059.005

pid	Process
4508	WScript.exe
4828	WScript.exe
1660	WScript.exe
5732	WScript.exe
5028	WScript.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	resgfvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.StartPage.ajg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion	regini.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-696679853-3915825385-3233721679-1000\{B43098C6-C94D-429B-B3DE-D2940561BC1D}	wmplayer.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings	jaffacakes118_Trojan-Dropper.Win32.StartPage.ajg.exe
Key created	\REGISTRY\USER\S-1-5-21-696679853-3915825385-3233721679-1000_Classes\Local Settings	resgfvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Software	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft	regini.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows	regini.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
4716	reg.exe
5504	reg.exe
4612	reg.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3728	unregmp2.exe
Token: SeCreatePagefilePrivilege	3728	unregmp2.exe
Token: SeShutdownPrivilege	2856	wmplayer.exe
Token: SeCreatePagefilePrivilege	2856	wmplayer.exe
Token: SeShutdownPrivilege	2856	wmplayer.exe
Token: SeCreatePagefilePrivilege	2856	wmplayer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2856	wmplayer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4424	jaffacakes118_Trojan-Dropper.Win32.StartPage.ajg.exe
3252	resgfvr.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 3252	4424	jaffacakes118_Trojan-Dropper.Win32.StartPage.ajg.exe	89
PID 4424 wrote to memory of 2856	4424	jaffacakes118_Trojan-Dropper.Win32.StartPage.ajg.exe	90
PID 3252 wrote to memory of 4508	3252	resgfvr.exe	91
PID 2856 wrote to memory of 5464	2856	wmplayer.exe	92
PID 3252 wrote to memory of 4828	3252	resgfvr.exe	93
PID 3252 wrote to memory of 1660	3252	resgfvr.exe	94
PID 5464 wrote to memory of 3728	5464	unregmp2.exe	96
PID 3252 wrote to memory of 5732	3252	resgfvr.exe	95
PID 3252 wrote to memory of 5028	3252	resgfvr.exe	97
PID 3252 wrote to memory of 5616	3252	resgfvr.exe	98
PID 5616 wrote to memory of 4808	5616	cmd.exe	100
PID 5616 wrote to memory of 5504	5616	cmd.exe	101
PID 5616 wrote to memory of 4612	5616	cmd.exe	102
PID 5616 wrote to memory of 4716	5616	cmd.exe	103
PID 5616 wrote to memory of 5164	5616	cmd.exe	104
PID 5616 wrote to memory of 4504	5616	cmd.exe	105
PID 5616 wrote to memory of 4304	5616	cmd.exe	106
PID 5616 wrote to memory of 3344	5616	cmd.exe	107
PID 5616 wrote to memory of 3568	5616	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.StartPage.ajg.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.StartPage.ajg.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Users\Admin\AppData\Local\Temp\resgfvr.exe
  "C:\Users\Admin\AppData\Local\Temp\resgfvr.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\WINDOWS\Temp\ialxokta.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:4508
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\WINDOWS\Temp\ialxoktb.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:4828
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\WINDOWS\Temp\ialxoktc.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:1660
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\WINDOWS\Temp\pag5.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:5732
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\WINDOWS\Temp\pag4.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - System Location Discovery: System Language Discovery
    PID:5028
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\wd.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5616
  - - C:\Windows\SysWOW64\reg.exe
      REG Delete HKCR\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4808
  - - C:\Windows\SysWOW64\reg.exe
      REG Delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5504
  - - C:\Windows\SysWOW64\reg.exe
      REG Add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\ /ve /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4612
  - - C:\Windows\SysWOW64\reg.exe
      REG Add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{C42EB5A1-0EED-E549-91B0-153485860982}\ /ve /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:4716
  - - C:\Windows\SysWOW64\regini.exe
      regini.exe tmp.ini
      4⤵
      PID:5164
  - - C:\Windows\SysWOW64\reg.exe
      reg.exe query "HKEY_CURRENT_USER\Software\Classes\CLSID\{C42EB5A1-0EED-E549-91B0-153485753982}\Shell\Z\Command"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4504
  - - C:\Windows\SysWOW64\regini.exe
      regini.exe tmp.ini
      4⤵
      PID:4304
  - - C:\Windows\SysWOW64\regini.exe
      regini.exe tmp.ini
      4⤵
      PID:3344
  - - C:\Windows\SysWOW64\regini.exe
      regini.exe tmp.ini
      4⤵
      Modifies registry class
      PID:3568
- C:\Program Files (x86)\Windows Media Player\wmplayer.exe
  "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\shipin.mp4"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\SysWOW64\unregmp2.exe
    "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5464
  - - C:\Windows\system32\unregmp2.exe
      "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
      4⤵
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      PID:3728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:5592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 787908d649a13dd58d7f2fc37de49e0e0fd18346eae75bff4cc3f745ea8419c2
MD5 5246e47156f9e9bf0e6e59eed7e96b4b
SHA1 7b7b51c92b15e6c806c0ab2d65cb1ee470c8f823
SHA512 63a39f69904d7ea30864299411a499dbd0307f8b342a665a7c9a34b68e4f8c1afbe5682ce7e439a0b20ee66a1bca26b8ac1c754be6f6266dc83d2ac0f7560047
SSDEEP 768:40aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbaQ:mZP2tFP3vqY8YqEMfTaBacgE
TLSH
T107258437D190B0C5CE2CB171E9ED8F09BA63A10B11A052465FF8A57E7A533D98D0B1EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 256KB
SHA256 acd538646c9fea2dfc79f091cdb99625d4ac20b1c5476524c485cd2948c64324
MD5 90b759671a939084e5409dd08c25f12d
SHA1 98b5968953308100a6e9083ff455ff689986a768
SHA512 af2a8a8264720457ee0bf68b4cb18bc0a70e4b61d45bb3fd68228077d3c8b5f42b2d57763d8453c096b077b714c5ae7213bfca6a0531d6b46f77b0560ab108da
SSDEEP 768:Uf0aleDxcg7KGVp3zT13VuI61HOdrrA9abhr1vfEwPRzitFrz:U69
TLSH
T1D5440137E5A0B084DF2CB571E2AC1F48BA73250B01E416465FF4A57DBB633D6890B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resgfvr.exe

Path C:\Users\Admin\AppData\Local\Temp\resgfvr.exe
Size 48KB
SHA256 7fe5d3d61fb4c5bb2df53fa4f942ee782079f7bcbef211f74806d0cd3412c0c8
MD5 2f1a2b27caa83d5e934fda77812c1339
SHA1 5f347fa675d7a364463178b87c858644b394c64b
SHA512 9f8479b3a75b16a52779ecb84006b35cfefdae96291061ba42b895db5fa9755e4740b8f0f3d3432e56dc30a663b915e2abf88aaeff81c7064060c5a647b965c7
SSDEEP 1536:tdoa0liPsRrPbPVTyLVN7TKMQLv7kIk9i6:tdoa0liPsRrPbPVTyLV
TLSH
T1FD23B51C8895EB55C813E7E0D5BBD0C6F22D2B1F8F498DF6711E9AA10623D6ED007E4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

shipin.mp4

Path C:\Users\Admin\AppData\Local\Temp\shipin.mp4
Size 7.3MB
SHA256 3a7f7e0679e4a20a4f510182afdf1a1ae7d80f2a6f0e96689ea867d77502a2e7
MD5 656cb8e6871208e47d139b133a70d524
SHA1 70ba26af8eaaec9e534c684edcf362dfb5c74db9
SHA512 60a5d5a3d4164b18583dfabc92d64f693665b113b171fafc77d3721c11b19f9d14e29cd620e9ae26f1c940bc5971467a1a08999aa5ec64e06b37d431a7bb4bd8
SSDEEP 196608:H6h4rK4mCz2lI5BbybqIQGld8cDdpXWQw:aSmCyywqSXhw
TLSH
T1E97633B5BBA255ABC0E5167812D52748BE7BFC308630CAEB9CE035134DD8BF06D617A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tmp.ini

Path C:\Users\Admin\AppData\Local\Temp\tmp.ini
Size 132B
SHA256 7e9aef3f91d3fe67be19764872b74ed7c5ba2bda6486826db931efd77bc036a1
MD5 be3ef47f6793fe41d73adeefbd447947
SHA1 664339b766a9dd7da65efd6ca72a80bb06b3e118
SHA512 71b840fba459565a781f8a2792f254c2e47b7fe993e8ddfad9ceecb7b770d763276481d5550ad57aede5d0f91823d578e9ccacb42eae42415453826af376722c
TLSH
T147C09B415454CA9191B16119305749144FF657B5E14595DEE88C16215543305C2574D9
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.ini

Path C:\Users\Admin\AppData\Local\Temp\tmp.ini
Size 94B
SHA256 8b7b12254dcfa165acf936b470e7757cf940ed02c4bd7e774c31ef71444e9d8d
MD5 46d1e606dbb47da1ecc20a81285748c4
SHA1 f7484218a818b07224ecb3600d3d6ca743501f1d
SHA512 dfb79ae2988d665ea55069c5dab19b67d38b0e1b3a025e262d8a7ebfe036f1ca1fec75f160845f4da0764bf4dd1100f0c5609486b6c865eddc94065914e34847
TLSH
T152B012422018C0119072210825974C101FE54765900196CC888809212253986C0691CE
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.ini

Path C:\Users\Admin\AppData\Local\Temp\tmp.ini
Size 93B
SHA256 b9a1da3e278f3a979491e5e21a3800e9c0cc035ddd3bf5ead4f4eeddb1274c77
MD5 955643319771800b82d6ea559e5beff1
SHA1 8f0f28dca1651c74376796845de4cfacd39475fc
SHA512 d613f10d2942986fded596203bcf73ed9ce90578e413cdb2fe31e3bec20353e2300df1e9eb10cd69169048534932ad2f782fcfdb7a0ef6b323af3f63f668fd32
TLSH
T1C8B012416018C02290E1320820474C100FE557D9B00552CCCC4C09201543105C1160D9
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.ini

Path C:\Users\Admin\AppData\Local\Temp\tmp.ini
Size 92B
SHA256 aacaee14777d3b9bb6ba34d98f11c831f27484d0fcc5d212d54621c531a43d63
MD5 bdd8ffa86ca807b1a2d6655fa6964d8a
SHA1 c7df18144c56a3df5f26adc149f9f61a332ce73a
SHA512 a78006f68a762685e7489ad394c918e8c494d742c4cf6a547a0e0e20335b9f91e8ecc9e67961c3e266425ea33e3d01afc99c80769d31b2d9337133fddf32b95f
TLSH
T146B0124224008002E061260420674C208FB18B55E00A51D8C8482A2115C36C5C091CCA
MD5 SHA1 SHA512 TLSH

Submit Download

wd.bat

Path C:\Users\Admin\AppData\Local\Temp\wd.bat
Size 1KB
SHA256 3700c7a76f95e48aa51c279e4258f59503986af84c15e7e357c4e77eefad202b
MD5 9d290e6868e77fb51f94a639ee6e2dc2
SHA1 39b0989e4ddf2632c802cfa1922f039683ae7e02
SHA512 9690795b7d997bcf9eb0601ee43947041bd98de35148c951f8e03b4404518cfc2e290ecd4aa2be37103240ca423ec108461127bcb842257cd261041d9b430dc7
TLSH
T124315A5A3C46C912E1F5E21860A74C10CBEB47EBE004EDDEF88C3A701653789C1AA1CE
MD5 SHA1 SHA512 TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 1ff07d22f216be450ac6252893527b26c5889dcdc5fc795e5bee091c99da796b
MD5 b84690cf4328907df0650dab73774673
SHA1 9f7b2d050506ce38126f34ecfb3d52caedf7978b
SHA512 1a468b2b6d625b1914cb747597e3d00d869c02967406854acbe15bcfce7f008cff97d46f6021d37827e9358f3ba09705bfdf8a6fd81719f0e512d49011465ae2
TLSH
T1532137574A0AE4B5CDA287B368CC8A2773BAA7CB5354D015B3CEE01A8C4553E633D17E
MD5 SHA1 SHA512 TLSH

Submit Download

ialxokta.vbs

Path C:\Windows\Temp\ialxokta.vbs
Size 13KB
SHA256 5e3ac84530b01247869467ff66e52701135390f5d69dbb9014773772f5ad2c6c
MD5 5caacdccef92b0b1920d55e91ae033ed
SHA1 248cc4010fd642e0fe0c5f416f30fc83af104cfc
SHA512 44e364394c9eb10bd194984585b99e9bb322506a15c096dff42af507ab8c3756909b6e94674652a30e63746fb1ba5b05d561c3f1fae0df0aa0e4b03bd838e221
SSDEEP 96:ONAt5OMV6bztfRcA+VQjoE0LsxWUAPsE4rPbDFpVWYiszGznYiVvJxV9h4:Omt5ONb/+TPsE4rPbPVNly0EzVX4
TLSH
T1C752111CD9A9EF154C1777C0A5BBE0D2F5292F1F4E098CB1612D9EE20623D6ED017E8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ialxoktb.vbs

Path C:\Windows\Temp\ialxoktb.vbs
Size 14KB
SHA256 efb1d5b1362c5c75e3a5cb90030d7601369b97f16a75b291900b6f95ef6b6583
MD5 7d31f18d6e1fd2eb829e90f5d18d80e5
SHA1 300fb7f43945f908d7d87cde9ae45c6190d34636
SHA512 9052753bb25c8656a2d8d58fea1931bc4dee51f4ab8948910424535cc382bef8c52c1892e5b6f93c0b5fc58ec022c12637f03b989fd33bf492a8679ab8a19a42
SSDEEP 96:OuhSm0TORW5h+R2Np08Glzlm46KD1CvCmCXCsC/C2tWCDtBCzdCsC8AYCsCzzCil:OS/BRW5h+R2Nu8GZm46L7PuL4
TLSH
T16462EC6C88D6FA61481367C489ABD1C6F22D2B1BDB498FF3702F9B610523E5ED04BD46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ialxoktc.vbs

Path C:\Windows\Temp\ialxoktc.vbs
Size 8KB
SHA256 daedafd337838843f702f5a9dff4c0283b2ed9e46d7e7f93bbcf1c75ef3b38be
MD5 43685fc15704db0dd795fb2643dd4efc
SHA1 5e0e4f81a81874392d686675b4d9a38e3c04540f
SHA512 fbee4c6565fccbc7881ce729e9839a8854d9a278dfa1b4a143db69d1ce7f39ce507894f887a58ff265c91a17162a762757c4a1546404c142490dbef886681091
SSDEEP 192:Oxl71g1q1yi1G1Ai1j1J1d1Ji1j1e1i1v1pe1TM1Tx4:Oxl71g1q1p1G1v1j1J1d1c1j1e1i1v1+
TLSH
T1FE02E72C4854FA574817FFC0D66FC0C4F13D275F8669EAA9705F1AE64613C3AE40BA8A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pag4.vbs

Path C:\Windows\Temp\pag4.vbs
Size 2KB
SHA256 77362594f0d40b1efa5b76b184cf4e6ae3568ea9217d24daad512db86b1c81b5
MD5 61f064efc44327325d29c2a9ca502fa4
SHA1 2473a629a86922afb7e50a2dee104c440502f877
SHA512 e27fce232a2cbda59fdb6065be1bb3fe6658091ef2d201ebf88c214cc04f994def1f90588a954578356cfc55884f616f583310a77fa0cba96a3bfeb34ad0350e
TLSH
T18951806CD9E2EF168817A6C05AF755C7F4092F0A0F898CB3704D4E890B63E6E960BF45
MD5 SHA1 SHA512 TLSH

Submit Download

pag5.vbs

Path C:\Windows\Temp\pag5.vbs
Size 2KB
SHA256 3165d84ec311cf7b6fb417b86b0d8f5123b10ebb931eaea3560b735113191a4f
MD5 20ed21eb1b2628239046c8182e155bb9
SHA1 b1b32a754f21c35b9cf2bfa45a4656ea3fb5d356
SHA512 547d9783c3cf932f5307276230c1edb3fbd091412364c99e4f54cafa44551beb71c7ef35e5344ff16f2cba9781b471a5d3364e6c5ef0a6bd653a1ee805a5286f
TLSH
T1DA51963CDC57DB51C803E7C062A794C6FA1C3B1FDA5A0FF2B01E56690512DAD925BE0A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2856-104-0x0000000007720000-0x0000000007730000-memory.dmp

Download

memory/2856-105-0x0000000007720000-0x0000000007730000-memory.dmp

Download

memory/2856-103-0x0000000007720000-0x0000000007730000-memory.dmp

Download

memory/2856-102-0x0000000007720000-0x0000000007730000-memory.dmp

Download

memory/2856-107-0x0000000007720000-0x0000000007730000-memory.dmp

Download

memory/2856-106-0x0000000007720000-0x0000000007730000-memory.dmp

Download

memory/2856-109-0x0000000007720000-0x0000000007730000-memory.dmp

Download

memory/2856-108-0x0000000007720000-0x0000000007730000-memory.dmp

Download

memory/3252-64-0x0000000000400000-0x000000000040C380-memory.dmp

Download

memory/4424-15-0x0000000000400000-0x0000000000B630D0-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads