b7dcfc7ae08a5856286d61119fa14bcf18cb873cfd200645327d56ec7a5e6983

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
Size 57KB
Sample261012-ydcrksh13p
SHA256 b7dcfc7ae08a5856286d61119fa14bcf18cb873cfd200645327d56ec7a5e6983
MD5 306ffb7574cb22a96ffd0ac049722861
SHA1 cc68498d496cf1c21911d2d89d2254a5afd3663f
SHA512 e5be42db23e69dd686052cc442d9d71987a042821e817f415ff01d62dcf74c780557a6e6ec2ddf62124fcc1efc374a32cea4f846204e820b800ef49c7b4db3c1
SSDEEP 1536:ECM6Ys4njatv0ubeMFrQYRKz4ka5QGdKx6:ECsDWzeurQSKz4kauGdK6
TLSH
T1C943F16443889C88E934DC790E82CD1C146CFA1BB15E7D97B78C589FBE079975CB602A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
768	attrib.exe
4660	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	inlD3D7.tmp

Executes dropped EXE 1 IoCs

pid	Process
2400	inlD3D7.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2672	cmd.exe
3576	cmd.exe
1044	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	inlD3D7.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	inlD3D7.tmp

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inlD3D7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 53 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "498598988"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\User Preferences	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283841"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a000000000200000000001066000000010000200000007fee692ba0a38ac9e14684aa001ffc2c57635413e17db7ccfbf8ecc5f93a997b000000000e80000000020000200000007ef8dff87649133e0f5d084cf52f61cdc409c94bdb304f48f98ef3a54ea73ee2200000000fb9dfc7e5f5f992af11c21a5bf542dc8304ba9d563b04cc31277ae71d7c5a7940000000799723d1db33719773019a220fe371902884823d1b5432d9b5d97c72033f189362310e8826143d303d088edf658da744232319248e7103a3c2116dd8d399534b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a4b6f5895add01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE8SSC&market={language}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283841"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BD15A8CF-C674-11F1-B5F1-62BF8547FD78} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a00000000020000000000106600000001000020000000b367e79bf48068a66eb6585d867a68d7a804d13a03c4beb9158b684073b5fc2d000000000e800000000200002000000052464439de0e36204f619ccd8a1fc8553c2e69905bb7f06eb3da54017f756838500000008e9398c23c88f3c2d8918c59bc109d229bd472556bbb887f90bc2fed346f37b1361a848ec052dee144139c3495f7c9b82c63b132a64620b1609e74bdaff37df739cff78cf7c6a99c092fde981c3e0fe6400000007162e1ec2379f612a83141504564f8823725dd3e037f55a6279b322c5208a4bff189f3e71af623433d4c9e4d849ac63ec841966b99e444df92f28e2d35a198c0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a00000000020000000000106600000001000020000000b16377bb1e3174470c1fece2111ec8bdfcc2bdcc9e671e1cc7a29e7fdffce4b6000000000e8000000002000020000000da40c9abe2b38cd9c80d6e615b45bb16c13e720a39e252d92ad555fedd4dc06d10000000eee71a807407bb07994dd0174942131940000000d133f9e6a409e0d681caa355e6e7de539c5e8733e4ecee30be702fdd129dbba674545bc54aee1838f95ec1af0f0aa823487571c9e9a59bde3a3c6699f6428285	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2454782488"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0008adf5895add01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = 3b57edeb3942dd01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2458689239"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IENTSS"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007c7304824aa2b6428e255c2f0c9d765a000000000200000000001066000000010000200000002621288e7f8009c66c8c4a0c381adbdc40e18494cbd7f96be800f4f7b27f0cf2000000000e8000000002000020000000588db5ab156dc92e287a6b6da55398e1a11cc6cffaf6970e033cf4f473e0a7f4200000003d8191434a0122a984dba015fb641d6bd6fc2f251fbc82d4fe99fdf1dd47c307400000003750bb0352782871337ecfde6be9e1084d40ae7ce9809c2154f2b9f70e8857b55d0e7ce804716f5c09fa6b793674847d9caedbc95facdf7b9817fda05298c614	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?o"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?o"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\3.bat\""	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3324	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
Token: SeIncBasePriorityPrivilege	2400	inlD3D7.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5676	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5676	iexplore.exe
5676	iexplore.exe
4024	IEXPLORE.EXE
4024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 2672	3324	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe	102
PID 2672 wrote to memory of 3576	2672	cmd.exe	104
PID 3576 wrote to memory of 5676	3576	cmd.exe	106
PID 3576 wrote to memory of 1380	3576	cmd.exe	107
PID 3576 wrote to memory of 1044	3576	cmd.exe	108
PID 3324 wrote to memory of 2400	3324	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe	110
PID 5676 wrote to memory of 4024	5676	iexplore.exe	112
PID 3324 wrote to memory of 3444	3324	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe	113
PID 1044 wrote to memory of 3524	1044	cmd.exe	115
PID 1044 wrote to memory of 1080	1044	cmd.exe	116
PID 1044 wrote to memory of 432	1044	cmd.exe	117
PID 1044 wrote to memory of 5080	1044	cmd.exe	118
PID 1044 wrote to memory of 4076	1044	cmd.exe	119
PID 1044 wrote to memory of 768	1044	cmd.exe	120
PID 1044 wrote to memory of 4660	1044	cmd.exe	121
PID 1044 wrote to memory of 4504	1044	cmd.exe	123
PID 1044 wrote to memory of 1652	1044	cmd.exe	124
PID 4504 wrote to memory of 5072	4504	rundll32.exe	125
PID 5072 wrote to memory of 5128	5072	runonce.exe	126
PID 2400 wrote to memory of 4232	2400	inlD3D7.tmp	135

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
768	attrib.exe
4660	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\julia_fun219.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\1.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWw.cnkankan.com/?82133
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5676
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5676 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:4024
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\1.inf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1380
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\2.bat
      4⤵
      Drops file in Program Files directory
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1044
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:3524
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:1080
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?o"" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:432
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5080
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\PPLive\3.bat""" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4076
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:768
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4660
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\2.inf
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4504
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
- C:\Users\Admin\AppData\Local\Temp\inlD3D7.tmp
  C:\Users\Admin\AppData\Local\Temp\inlD3D7.tmp
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inlD3D7.tmp > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4232
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3444

C:\Windows\system32\grpconv.exe
grpconv -o
1⤵
PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 77f092574df221fef3caa5611bcc1a8c78381ec8c0c54bb107e6cc5355c4840f
MD5 5163274101cd2a42b5ea54c9cb7602ff
SHA1 60b5fde304e075da3de47020d42f3bfd5c322f52
SHA512 df38a3009056658dd88ffbb976737d1bd9258f76ab6e6bef8af1654e7ec233d041b4ed4c913734796d3be5635e2b80c93e1da128d63e2269be61d7205c7195f8
TLSH
T132F0D4D5A03EF8602D5798FC62712B4B603191E62C61147435781DFD48567773E5E035
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 db0742a9f2758ceb631776adf8a226c96b9967e1007b30f59d390c2af7fdd6ba
MD5 7078b11357d65265f95e6def4120bd35
SHA1 c569a253911579cfec87b153819c980083ba3d83
SHA512 112dd4d3866cbcef5fea319f5495cdb6b53e8bd52f10d664588acb124fee37bf5a2caf321c5e1d205fd1308ccdaec405ac27831cad084c97bd1e4ecf7a7863f9
TLSH
T15BE0C02411FA831FF1E4E0394BD9782194E9F02B241993B42BC49B04BB02A009D0292A
MD5 SHA1 SHA512 TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DV9ET3T5\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jm_setup_qvod[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\FB6DDX4X\jm_setup_qvod[1].htm
Size 11KB
SHA256 b5bc80c286321d117d4faf28c8ecd32cd4499e926034205f6fbcd181c5c39469
MD5 80cd854c562c25dfac65c15726ef2253
SHA1 1cf7c23c94524fb604a99aa5b37e568fbdb435dd
SHA512 61f9886f813763f507bbb496a9361c7a239e5e4a3f9545f1741797469e2bb42e42cc73176766c9219578c5cfa79bf95e4de5c22581a9f7016a570785e80d7e72
SSDEEP 96:gORGfADiML/HlXsjFPkIQlvZPy4REyJ5W+GW+oW+JidFkl6a0VUSN0ELXp+E6yL:ZgYDiMLPlshkIQlvxyXyJskGSELXp0yL
TLSH
T1B732B71696F702206517C4998BBF77287774E043D80BC96DBACE1398CF8C9CAC46366C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favicon[1].ico

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\T1P4NEBX\favicon[1].ico
Size 4KB
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
TLSH
T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

julia_fun219.bat

Path C:\Users\Admin\AppData\Local\Temp\julia_fun219.bat
Size 53B
SHA256 1abcea214b9b2bd76cc04be07ae2d4d70371e6ca443d99f4f1327afe7a5fc647
MD5 23962a245f75fe25510051582203aff1
SHA1 20832a3a1179bb2730194d2f7738d41d5d669a43
SHA512 dc36b64f2dbb710652900a31295c148760b0c44eae13515aa29613916c9dffe3d8e55ba61568f7c27b43bf0c341f7dcd4b9c721f81627fc6bb915b15c358fe80
TLSH
T15D90022415DDD75D5511445317B9944C516446902EA9361487805A4853C1C05B892002
MD5 SHA1 SHA512 TLSH

Submit Download

winrar_config.tmp

Path C:\Users\Admin\AppData\Local\Temp\winrar_config.tmp
Size 660B
SHA256 b1a31a74cc88d0f8e39aaebf58a724b89391dc3fbac733953790edf8ded8172c
MD5 c40ea8f677b3f48bfb7f4cfc6d3f03ab
SHA1 10b94afd8e6ea98a3c8a955304f9ce660b0c380a
SHA512 409b8a45576bf08e185446b13a512c115df7483ff8ec30ea51ee93ee1ac8153ae3b615650ff69a5d1e41fa0cd57fcdc4c5d03b4b4453431114ac018f48e194d9
TLSH
T1D301DDCECC068802246DDE62B3BE0804C347B2CF8A80D8B1C7615F442E4221322D32B7
MD5 SHA1 SHA512 TLSH

Submit Download

1.bat

Path C:\Users\Admin\AppData\Roaming\PPLive\1.bat
Size 3KB
SHA256 f1a2f9fdebb3cac24756e53fa5e1628b2bd1cc130480c1878e3b3bc880575cd1
MD5 b7c5e3b416b1d1b5541ef44662e1a764
SHA1 8bff7ea2be2f3cf29f2381d8007198b5991ca3ae
SHA512 65dbd6a7a7cf6fec00e6b0f1d7d5655769e6087ad09cad74c91c5a3395e675ac8f9df5c7185327e6f8dd03ddb60504400f54237d9e4b53c8b08e7e3d41ee61fc
TLSH
T150719ACE3846C00AB40E14C4DB7469A7F95DA0EB85E29C05B10B9BB109C47C13F8EA6E
MD5 SHA1 SHA512 TLSH

Submit Download

1.inf

Path C:\Users\Admin\AppData\Roaming\PPLive\1.inf
Size 270B
SHA256 5313ce7c036d06b3970f27db432912a3edccd60266afb6510b9a682e8bca16e7
MD5 091e50aee0d79aa7d4976aecb393c5c5
SHA1 f755112c5d09bceabc60aaf375011883467e1e1e
SHA512 723e0fea1ec2ac932dabf370cf3e8622a9df607ae52d219881dfa0f0afad7adc5f55f816f5c1b617b963e818f2093470da070d9b858037222918065573067d75
TLSH
T1D6D05E8D9E1862DCB1113810E533D765FE755851B570B60CB1CAC6040E10E852DA6EF7
MD5 SHA1 SHA512 TLSH

Submit Download

1.inf

Path C:\Users\Admin\AppData\Roaming\PPLive\1.inf
Size 492B
SHA256 fe0dfb3458bfe2a3632d365e00765fa10f14d62e7dfa8b70a055c7eb9fdb6713
MD5 34c14b8530e1094e792527f7a474fe77
SHA1 f71c4e9091140256b34c18220d1dd1efab1f301d
SHA512 25bb09b526e1e9f5c6052f1f7c36b37c956c1b5649936af8df3abfcf120c931f3d2603e17a061cb99d8c8074bfb1973a5423cce89762fca53cd46aeb3e8944a2
TLSH
T1B7F0E25D5B1461CDF0127400AA32DEB5AB655411F971751DF08EC9050F10AC52FAABFA
MD5 SHA1 SHA512 TLSH

Submit Download

2.bat

Path C:\Users\Admin\AppData\Roaming\PPLive\2.bat
Size 3KB
SHA256 81f64f42edfac2863a55db8fabd528c4eefc67f7e658cad6a57eeec862e444e3
MD5 6b78cb8ced798ca5df5612dd62ce0965
SHA1 5a9c299393b96b0bf8f6770e3c7b0318a9e2e0cf
SHA512 b387ba10021f3284d1406d520a2c8b3ba0c87922d67c79394c1aa50c631194519ac6bb5b898956533f040d48e1c7b202734e0075f8fc8c8bfab82c8ef359b28e
TLSH
T1D97159D1A811D4CBD90F85E3CB602253B90EE9C706D26B5CE65347B828F1F8157EC69D
MD5 SHA1 SHA512 TLSH

Submit Download

2.inf

Path C:\Users\Admin\AppData\Roaming\PPLive\2.inf
Size 247B
SHA256 6cdfa9b7f0e1e4ee16bc8ce5d7448d47ea8866c1f55f3e56be5c2a4d183ca534
MD5 ca436f6f187bc049f9271ecdcbf348fa
SHA1 bf8a548071cfc150f7affb802538edf03d281106
SHA512 d19e20aabddad6b0284f8c1d473e9180f30b49d4d8b54f26e7c8630228e16b1f6ba04023c5e8b1993d8a10d97adcfff683b216f79b9981bf16181641aebdd591
TLSH
T1E0D02E3A2A08A829F2602A2002277CC8AAE62A8620C8FA0C22941004A380518E4AE0D3
MD5 SHA1 SHA512 TLSH

Submit Download

4.bat

Path C:\Users\Admin\AppData\Roaming\PPLive\4.bat
Size 5.8MB
SHA256 890a7018f96639b441011b741113ece9b7c5e35bfc7ccac37b39a47bee2add70
MD5 8e669c57c232dfb7b12aab10ce32ba59
SHA1 e19a880563b47693ea4a3892c6fe1505349f8023
SHA512 47c2b634ddd54bee7f46cf0ba2d00cbb1dbbe090a68c03fc12c8c4bbab0ec9e2cda42b95512b3c437dc5e726c9a3480a5016fbf3d5b1ca0160a6edb3943103fa
SSDEEP 98304:psjEZDoJbVKEhxuxjuQHXiwkIZuBckUryuLfJtF5:pZAbVKogsSUqkUFJtF5
TLSH
T14A566C212648D462D6F32537157CB77391AFE5706B3008EB8212FAB92D325C25E3A79F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

├└┼«└╓╘░.url

Path C:\Users\Admin\AppData\Roaming\PPLive\├└┼«└╓╘░.url
Size 121B
SHA256 4aa583d8aa113497282e4fbdb0ab2c9d9d7bb7349b8223729a69dfcb81822f57
MD5 dcca714db5e7ade1599b9a87013c36cd
SHA1 db45c35461712c98863e4da6c0dc72628328fb76
SHA512 8ab04ff5796fef681d25808df4cf7e9cc428eb1b861e8cb45fcc6ea04102e979302506bb576f64b43c29c00d05aac076101f6219a6fe5e460806b168a5995280
TLSH
T120B02B20018DD01E4003883F0932DCC4DC4061C4954BCD40824149C804400055CD4304
MD5 SHA1 SHA512 TLSH

Submit Download

╠╘▒ª╣║╬∩.url

Path C:\Users\Admin\AppData\Roaming\PPLive\╠╘▒ª╣║╬∩.url
Size 117B
SHA256 6afbe4af1c3800a4e2ebefc3e065cfba7281aa94e8e0108373882f88a642e4ca
MD5 06a02fb586e1e69ab82e7423223d968a
SHA1 8655b56cc7968090dcc6f252525188cf9078126a
SHA512 6d6c573cef24980617fe29ed549607aa7dc8b5c66e7874be2d87244e9107af8b5321ff2aa40bfd498e5a83046da7beba2cfd3b984ff9f0e7a80e069f52f65ef3
TLSH
T1FFB02B24434DC01E4003C56F05344844DC1120D0957FC900C240499808800019CC8500
MD5 SHA1 SHA512 TLSH

Submit Download

░╦╪╘╔½═╝.url

Path C:\Users\Admin\AppData\Roaming\PPLive\░╦╪╘╔½═╝.url
Size 118B
SHA256 09dd2f0512224f9b035ea73c05e7baace47a6187c9fef9027a008083f08585e7
MD5 0c8d441e4a5f649b3f57e042e2d32d3c
SHA1 5cb3debced6674de14503ff23044373c1a0b1477
SHA512 95a2d68aaed2612e3c1ac3b1c7827544065ee43623f6358af9957ddd5536b4eacde2c27eae0aede7f0125c639950e6d15bba2f90a6df74a60f7530f4e4305bf2
TLSH
T147B09B24468DD15E5447456F49794854DC5125D4695FDA44C3414E5C15814416DD9643
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3324-6-0x0000000000DF0000-0x0000000000E17000-memory.dmp

Download

memory/3324-5-0x0000000001220000-0x0000000001223000-memory.dmp

Download

memory/3324-1-0x0000000001220000-0x0000000001223000-memory.dmp

Download

memory/3324-107-0x0000000000DF0000-0x0000000000E17000-memory.dmp

Download

memory/3324-0-0x0000000000DF0000-0x0000000000E17000-memory.dmp

Download

memory/5676-104-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-146-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-92-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-91-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-89-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-94-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-68-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-98-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-70-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-103-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-102-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-97-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-95-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-65-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-67-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-105-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-88-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-77-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-108-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-109-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-111-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-114-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-115-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-78-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-79-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-123-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-132-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-80-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-141-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-93-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-155-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-154-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-152-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-151-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-150-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-149-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-161-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-168-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-173-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-174-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-178-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-179-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-180-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-181-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-185-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-186-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-184-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-183-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-187-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-197-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-200-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-69-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-66-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-64-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-226-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-227-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-62-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

memory/5676-235-0x00007FFE5D9F0000-0x00007FFE5DA5E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads