Overview
overview
7Static
static
5jaffacakes....d.exe
windows10-2004-x64
7jaffacakes....d.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3COPYING/COPYING.pdf
windows10-2004-x64
3COPYING/COPYING.pdf
windows11-ltsc_2024-x64
3COPYING/COPYING.rtf
windows10-2004-x64
1COPYING/COPYING.rtf
windows11-ltsc_2024-x64
1clamd.exe
windows10-2004-x64
3clamd.exe
windows11-ltsc_2024-x64
3clamdscan.exe
windows10-2004-x64
3clamdscan.exe
windows11-ltsc_2024-x64
3freshclam.exe
windows10-2004-x64
3freshclam.exe
windows11-ltsc_2024-x64
3ico/ressource.exe
windows10-2004-x64
3ico/ressource.exe
windows11-ltsc_2024-x64
3libclamav.dll
windows10-2004-x64
3libclamav.dll
windows11-ltsc_2024-x64
3libclamunrar.dll
windows10-2004-x64
3libclamunrar.dll
windows11-ltsc_2024-x64
3libclamunr...ce.dll
windows10-2004-x64
3libclamunr...ce.dll
windows11-ltsc_2024-x64
3libeay32.dll
windows10-2004-x64
3libeay32.dll
windows11-ltsc_2024-x64
3msvcm80.dll
windows10-2004-x64
3msvcm80.dll
windows11-ltsc_2024-x64
3msvcp80.dll
windows10-2004-x64
3msvcp80.dll
windows11-ltsc_2024-x64
3msvcr80.dll
windows10-2004-x64
3msvcr80.dll
windows11-ltsc_2024-x64
3snipedscan.exe
windows10-2004-x64
3snipedscan.exe
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/10/2026, 17:59
Behavioral task
behavioral1
Sample
jaffacakes118_Trojan.Win32.Hotkeychick.d.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Trojan.Win32.Hotkeychick.d.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
COPYING/COPYING.pdf
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
COPYING/COPYING.pdf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
COPYING/COPYING.rtf
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral8
Sample
COPYING/COPYING.rtf
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral9
Sample
clamd.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
clamd.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
clamdscan.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
clamdscan.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
freshclam.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral14
Sample
freshclam.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral15
Sample
ico/ressource.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
ico/ressource.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
libclamav.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
libclamav.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
libclamunrar.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral20
Sample
libclamunrar.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
libclamunrar_iface.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral22
Sample
libclamunrar_iface.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral23
Sample
libeay32.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral24
Sample
libeay32.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral25
Sample
msvcm80.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral26
Sample
msvcm80.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral27
Sample
msvcp80.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral28
Sample
msvcp80.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral29
Sample
msvcr80.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral30
Sample
msvcr80.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral31
Sample
snipedscan.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
snipedscan.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target jaffacakes118_Trojan.Win32.Hotkeychick.d.exe
- Size 4.4MB
- Sample261018-wkvvmaca65
- SHA256 69c0164bd5a3f28737152241ee1a7750c37ab6e80c4c456f6a34237da73c2f71
- MD5 aff493ed1f98ed05c360b462192d2853
- SHA1 3f6ed3c3789a54de20ddcdebd640d1e499f6fb6f
- SHA512 22fc5b498cc574d93d28c8010f80f135a44b5ae3bbb9b3582d807225059187fceac1fc71a4a091f4b0f4e576fd24b35da8c877919c7c721815c3bdc296acbbd7
- SSDEEP 98304:OknlbTXIM747mtTXcWH7jzxNlb5SW5hCIpBUbrUbhkEUQf5Fkcn2IbzR8i2j:7ndcM7Qm1Xzzx/VSS42ePQf56cXzWF
- TLSH T11C26333C5B95747FD81750F946A8A7C8FA208F23A9B8063319515B4EB369F6F8CAC11C
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sniperscan.lnk jaffacakes118_Trojan.Win32.Hotkeychick.d.exe - Executes dropped EXE 16 IoCs
pid Process 4236 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4484 Sniperscanengine.exe 1980 clamd.exe 5412 Sniperscanengine.exe 2812 clamd.exe 996 sniperscanengine.exe 5076 sniperscanengine.exe 2428 clamdscan.exe 3184 clamdscan.exe 2384 clamdscan.exe 3680 freshclam.exe 2916 clamdscan.exe 3288 clamdscan.exe 4564 clamd.exe - Loads dropped DLL 26 IoCs
pid Process 5108 jaffacakes118_Trojan.Win32.Hotkeychick.d.exe 2812 clamd.exe 1980 clamd.exe 1980 clamd.exe 1980 clamd.exe 2812 clamd.exe 2812 clamd.exe 1980 clamd.exe 1980 clamd.exe 2812 clamd.exe 2812 clamd.exe 2428 clamdscan.exe 3680 freshclam.exe 3680 freshclam.exe 3680 freshclam.exe 3680 freshclam.exe 3680 freshclam.exe 2384 clamdscan.exe 3184 clamdscan.exe 2916 clamdscan.exe 3288 clamdscan.exe 4564 clamd.exe 4564 clamd.exe 4564 clamd.exe 4564 clamd.exe 4564 clamd.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
resource yara_rule behavioral2/files/0x000c00000001c6be-62.dat upx behavioral2/memory/4484-63-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/4484-74-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/5412-84-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/996-137-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/5076-139-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/996-138-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/5076-140-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/996-146-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/5076-147-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/996-148-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/5076-149-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/996-150-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/5076-151-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/996-152-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/5076-153-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/996-154-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/5076-155-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/996-156-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/5076-157-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/996-158-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/5076-159-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/996-160-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/5076-168-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/996-169-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/5076-170-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/996-171-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/5076-172-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral2/memory/996-173-0x0000000000400000-0x0000000000478000-memory.dmp upx - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\ins.tx sniperscan.exe File opened for modification C:\Windows\ins.tx sniperscan.exe File opened for modification C:\Windows\ins.tx sniperscan.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4432 cmd.exe 5716 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname freshclam.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain freshclam.exe - System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jaffacakes118_Trojan.Win32.Hotkeychick.d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sniperscanengine.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clamdscan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language freshclam.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clamdscan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clamd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sniperscanengine.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clamd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sniperscanengine.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clamd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sniperscanengine.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clamdscan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clamdscan.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language clamdscan.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4236 sniperscan.exe 4236 sniperscan.exe 4236 sniperscan.exe 4236 sniperscan.exe 4236 sniperscan.exe 4236 sniperscan.exe 4236 sniperscan.exe 4236 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 4484 Sniperscanengine.exe 4484 Sniperscanengine.exe 996 sniperscanengine.exe 996 sniperscanengine.exe 5412 Sniperscanengine.exe 5412 Sniperscanengine.exe 5076 sniperscanengine.exe 5076 sniperscanengine.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4236 sniperscan.exe 4236 sniperscan.exe 4236 sniperscan.exe 4236 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 4236 sniperscan.exe 4236 sniperscan.exe 4236 sniperscan.exe 4236 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 4732 sniperscan.exe 1836 sniperscan.exe 1836 sniperscan.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 5108 wrote to memory of 4236 5108 jaffacakes118_Trojan.Win32.Hotkeychick.d.exe 89 PID 1836 wrote to memory of 4432 1836 sniperscan.exe 95 PID 1836 wrote to memory of 4484 1836 sniperscan.exe 97 PID 1836 wrote to memory of 1980 1836 sniperscan.exe 98 PID 4732 wrote to memory of 5716 4732 sniperscan.exe 100 PID 4732 wrote to memory of 5412 4732 sniperscan.exe 101 PID 4732 wrote to memory of 2812 4732 sniperscan.exe 102 PID 4484 wrote to memory of 996 4484 Sniperscanengine.exe 104 PID 5412 wrote to memory of 5076 5412 Sniperscanengine.exe 106 PID 996 wrote to memory of 2428 996 sniperscanengine.exe 107 PID 996 wrote to memory of 3184 996 sniperscanengine.exe 108 PID 996 wrote to memory of 2384 996 sniperscanengine.exe 111 PID 4432 wrote to memory of 3680 4432 cmd.exe 113 PID 996 wrote to memory of 2916 996 sniperscanengine.exe 114 PID 996 wrote to memory of 3288 996 sniperscanengine.exe 115 PID 1836 wrote to memory of 4564 1836 sniperscan.exe 118 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hotkeychick.d.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan.Win32.Hotkeychick.d.exe"1⤵
- Creates a file in the Startup directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Sniperscan\sniperscan.exe"C:\Sniperscan\sniperscan.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4236
-
-
C:\SNIPER~1\sniperscan.exeC:\SNIPER~1\SNIPER~1.EXE1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c freshclam.exe --config conf\freshclam.conf > sigupdate.log2⤵
- Executes a command shell one-liner
PID:5716
-
-
C:\SNIPER~1\Sniperscanengine.exeSniperscanengine.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Sniperscan\sniperscanengine.exeC:\Sniperscan\sniperscanengine.exe /R3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5076
-
-
-
C:\SNIPER~1\clamd.execlamd.exe --config conf\sniperscan.conf2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2812
-
-
C:\Sniperscan\sniperscan.exeC:\Sniperscan\sniperscan.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c freshclam.exe --config conf\freshclam.conf > sigupdate.log2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Sniperscan\freshclam.exefreshclam.exe --config conf\freshclam.conf3⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3680
-
-
-
C:\Sniperscan\Sniperscanengine.exeSniperscanengine.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Sniperscan\sniperscanengine.exeC:\Sniperscan\sniperscanengine.exe /R3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Sniperscan\clamdscan.execlamdscan.exe --fdpass --quiet --no-summary --config-file=conf\sniperscan.conf --log=sniperscanengine.log --move=quarantine "C:\Sniperscan\libclamav.dll"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2428
-
-
C:\Sniperscan\clamdscan.execlamdscan.exe --fdpass --quiet --no-summary --config-file=conf\sniperscan.conf --log=sniperscanengine.log --move=quarantine "C:\Sniperscan\clamdscan.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3184
-
-
C:\Sniperscan\clamdscan.execlamdscan.exe --fdpass --quiet --no-summary --config-file=conf\sniperscan.conf --log=sniperscanengine.log --move=quarantine "C:\Sniperscan\libclamunrar_iface.dll"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2384
-
-
C:\Sniperscan\clamdscan.execlamdscan.exe --fdpass --quiet --no-summary --config-file=conf\sniperscan.conf --log=sniperscanengine.log --move=quarantine "C:\Sniperscan\libclamunrar.dll"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2916
-
-
C:\Sniperscan\clamdscan.execlamdscan.exe --fdpass --quiet --no-summary --config-file=conf\sniperscan.conf --log=sniperscanengine.log --move=quarantine "C:\Sniperscan\freshclam.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3288
-
-
-
-
C:\Sniperscan\clamd.execlamd.exe --config conf\sniperscan.conf2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1980
-
-
C:\Sniperscan\clamd.execlamd.exe --config conf\sniperscan.conf2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4564
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Sniperscan\clamd.exe
- Size 116KB
- SHA256 2d98a8e69cfd5e8a6932ebe732abcdd3a22dbbd4ca48d8be9fc4946b844e7cc8
- MD5 521dcd4c5a6f1933e2832b5768faf52c
- SHA1 ab5ed2b7044ae11156843cc824a514e95c1be79b
- SHA512 8e9cf6bf0f70a6c6b08f39eeeb8d31cd3d400135b69aa78000a9fff9f7cba06002e7ae1f9aedb5a0359e6811e364bb885b06a5c3db8f301c065008d8957aa575
- SSDEEP 3072:+D8aCRGSiX7QsYuzxPzkz6+8Ro8DM2Z6vs7GI7cYFO9FViDLM8NVe:gCW7QJYx7D+8RNQ2Z6vs7GI7jFgFViH2
- TLSH T1B6C36B92FD4A1865EE011BB162974BF3DB3BC427135202ABEB64CEB54D340D1E72A63D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Sniperscan\clamdscan.exe
- Size 76KB
- SHA256 c7844db3523895ee65de5a0ac104aa533e028e997cf7b2c6ca25a348d1033999
- MD5 82c5e113f6bc49d249e1847254cdedbd
- SHA1 559500ea387e1ac5d2445288a6827074f33b4d5b
- SHA512 d2525022f28aad5ae75230b7b4d7ec5b530955d988aa47e2cdf5986cbafb65dcf4f00672b207011086fd93bd6ef00146dac6e61f9e7d26952475e2ff78fef255
- SSDEEP 1536:HPvtCWB4+vU9T1cfMm8YS/FO1jFjw+iykbLM8uQSUV:vpvo1cD8V/FO9FViDLM8N5V
- TLSH T1DD7349A1ED4E0819FD105AB4629305B2EABFC4136353129F7B6CCDA54F312C6BB6983D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Sniperscan\conf\freshclam.conf
- Size 8KB
- SHA256 9963c42a489ea816d5c9bae895687a97be7b49ac5d47b27417b5c9eceeab9ab5
- MD5 32c8c3878da78532442e72910a61e3a1
- SHA1 2fbebfb4d4e100ed281ffde068d7d5bd325720e3
- SHA512 269855f264ea05f1556e353753b3f267b92b868c610f003013d37821fb02ea31a942e46f11ff1d8c17bc9fb792ee29ca7101a8d7113c4ba717b6d761eadf0886
- SSDEEP 192:35+NqHVW+G3xYNrQwLDJ2bdHKAKOSWLmLo5QGT7z6K:S+GxQD0bdbzLg7K
- TLSH T1AD02A34F37DEB7321C4341D8705AE3609746E27852267D21986EE32D2229076736BBFB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Sniperscan\conf\options.ini
- Size 1KB
- SHA256 7422ceda39783bd574dc423e6e7458e8194fae58cbf9d25649a6bf50403f6e6a
- MD5 f0424e24e4e2ad5d6735754146b6704b
- SHA1 277137c096290e2a30db0cf5c49a631fe3f0f4af
- SHA512 ec706a733cfc582514b155298f1e49c59f614667f31ce3a4ccb0690766a0c36356b9bee99a605f882ed42d660ed6be5c7288590e19e57820b22006190e97c83f
- TLSH T1B911A8C7773F6418E5064AA671B6731CF565F4C01344C37251B27E1352B3B8DA1892F5
- MD5 SHA1 SHA512 TLSH
- Path C:\Sniperscan\conf\sniperscan.conf
- Size 18KB
- SHA256 dc72f506f8166175537aaaed7db9e5e65507c071be6b3dd221abffa5b7b79378
- MD5 14731db2d63e4946cd794a8337c10371
- SHA1 5a80d8d7f03d0603c22d4d3aa970f0809e13733d
- SHA512 3dcf850122d26956df8bc64cd5b463991f6d1a3ad3046a32317f1abf7eddd9ba20c4596a2ed1241924c40ed2504bfea88cddac48f401bc323e42529179973a5c
- SSDEEP 384:jUfztinT2rCFu2KUQUczCD5zM0euo4R9lydHRhgw9g:8aTnKU1upzThgw9g
- TLSH T18A82A7077BCF6274058350D4718BF191AB2C96ACC3213D64F45EB658620F46B63EBFA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Sniperscan\database\mirrors.dat
- Size 936B
- SHA256 60d0cacb5e304b6af7c5db195b9a06499dbe72d5a481a9003a41ff3632304bc6
- MD5 85ce89a6f5a86a231d35026bdcfff566
- SHA1 fc730b4d9c14f354f1b05ab86884e64beab40480
- SHA512 835d2545f0372d6c0711921a464bb3a982e72888b9ed5853de2a0b39ba45a7e619a30590726e327a88fd90b3b5a6620c13da505b2240c42329bfb2d4a61f3bbe
- TLSH T1AF11D5A0F38B8320C0F201B2E8C6A74283A5CD080C6F27028891B6AE2C7AE303618032
- MD5 SHA1 SHA512 TLSH
- Path C:\Sniperscan\database\mirrors.dat
- Size 988B
- SHA256 9e184eb818275a7698d0b60b6f2ff6a9d09b676a11276a830b3ca646726def84
- MD5 974ebd0f19f4a337e88c703c65fe1416
- SHA1 ebb19fb89a60dee2f1993216a37ccafd8e203f31
- SHA512 f2cd91d8c4ac3c42d6a37dcf2e71fa684c386eafc1fd5e9ba56611b3c43a9a87265be44cacba2286f96d274a717b4aea2ca6b6389cd9c0dce19148f042250d9b
- TLSH T1EC11DCA0F78B8320C0F21172E8C6574243A5CD041C5F27028851B5AE3C75E303618032
- MD5 SHA1 SHA512 TLSH
- Path C:\Sniperscan\database\mirrors.dat
- Size 1KB
- SHA256 7952e79552b82d30b36b9a79c7d1f8d4086159c627fb8f08c7972376b443f825
- MD5 c6361e1d32bb367ee08d768f9cb3dbb7
- SHA1 f1cdfa1141c2432fd77f649aca9de984c6e308b1
- SHA512 b6e982b47b58b13cefce382e02fd05a9dca8e3cad56f93533687d7ad1f5be48fd6defd21e7285e55d65bfab5116e15a4db19d040a65779bfaab278c7321c5cab
- TLSH T16311DCA0FB8B8320C0F21172E8C6674243A5CD081C5F27038852BAAE3C75E307A19032
- MD5 SHA1 SHA512 TLSH
- Path C:\Sniperscan\freshclam.exe
- Size 128KB
- SHA256 291c8aa39966c45b999967cf5ac5ba9f41cd71200aed6633dae868efa9e8f4a2
- MD5 de9934468a09a2e9e09e80363cb21eb2
- SHA1 63a4b492e1a7884cded656a318d100986f739ae5
- SHA512 3d40cae3e9fd85e4986ced54de738d880d8b4e71305a242362034e1267d4a2409162305f3c09e237547e01ba82f6d35b14edf12fe6912bf364433297efec9c7c
- SSDEEP 3072:w8zvk+/bMcOwcSwAh+Li+HQ2gtgX5aqA8JIchW7veIFO9FViDLM8N+W:5A+/bMcrcKhQi+HQ2gtgX5NA8JIch+v7
- TLSH T18FD35B90FE590569D8101AB151670FF3EB3BCC576393428FA768CDB34B712E26A2E16C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Sniperscan\ico\ressource.dll
- Size 403KB
- SHA256 85e883fef7bea9b438c88423cd150291580b635a8321943f8867abf315a98d28
- MD5 cfee12ad654a201705a73081207c67f1
- SHA1 4018daa3eb89d365a8dad5c853908978e0fb9972
- SHA512 958e25d3727fa16eb7f3756e381ab993c2256f2374f5d7935f96f4fea54afd42f3df7c99115b870013ce1026797caa5949e18fbc520d13d26c6c61475f904043
- SSDEEP 6144:3k1CuAcc3BDQV978TzjFUYI0aw/I5uLd9skcyLB4wi6:3YAccxUV976zjFAp55uLd8yLj
- TLSH T127947B0A770CE616D4DC1A7486DED6B073B5FF51D8615A0BBAE87F1FF93328A1906280
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Sniperscan\ico\sniperscan.ico
- Size 85KB
- SHA256 457d7132978869733ac287eaa838994009f00e4b905817f9eaea47e686f41336
- MD5 d19abcb748f968a68b9992e612beb096
- SHA1 65a694eee18771529fbe0dc08295fd72cdb1c6d3
- SHA512 d4c28c0da72bb111bb472187f9dd119e65433f3e672b09e6d206799b8c5174f79fcaafd414552293efdaffebef3302be76efd36a5b2e61e75372f9155b6aec01
- SSDEEP 1536:+shoiAyiF1t1kW+UIY6OaYLy8VBX82lUFZsakvZ4SIivdHai00sRv6:+shuyQkW/I5uLy8U2lUz4ci1QRS
- TLSH T1B383BF0E970CBA56D0DD85B5C0CE84A06BB8FF45C5D59D4EA6D9EF0FD8168CC62138CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Sniperscan\libclamav.dll
- Size 3.2MB
- SHA256 b39a156b164a76fb4e701df0d2ae263cd4169f9c97670882dfd996d63e4721ec
- MD5 787379094325085da84b0807f1f6f0f8
- SHA1 52b00fb67cc9016343a0e06fa0db49c04e56038d
- SHA512 17e28e0275843ed2b5fe2b2c1e52ecc07012b22b1f23bab0531d93747d257d32c0fe5275ef75bed09523ddd4b782f92d61b32cb8c0fe969aff8a4e0d6c157455
- SSDEEP 49152:Rna7eOMnrVgPlUQQcrCzMGpqsTLN6LlysYYjY:Ra7Js62Txs
- TLSH T106E58CA9DF8F86E0D4464D7803B7D27F6B366E059364A1E3DB90EB74D9302E1407A788
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Sniperscan\libclamunrar.dll
- Size 64KB
- SHA256 c40e36d01fd6d38026e18e0ffc92e954b779d9f5d7e83d8e53856807696786e7
- MD5 bb50771cb48539ef7a535ec1a52cf39e
- SHA1 3ae1170198558a0df936714c5a1bd0092b9885a0
- SHA512 6aa0a8fd52c85710c924e5fc51406bc78b9da519400a4e0ca3da0d28c234a2e82f473d295649292d6ece6048a631fd22df302c4ae14ddc26d2f5db7e977715bf
- SSDEEP 768:elZ4m0NM+ipIUHSTiGrVXT6sY37AmUoXyRUww8SHQro8zFe3P:oZ0u+i2rVXZAAlUw9SHQrz03P
- TLSH T1BF534B0D9E5FD076EA050E74A5AA82E98FBC0D0BF3EA21FFDF919D8248711D900B4674
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Sniperscan\libclamunrar_iface.dll
- Size 25KB
- SHA256 72ac671739f3197dcfa85728593a6438c93452438321031f1a93edaaaf02c7f6
- MD5 0672b8a9a1a5ff8b3f401b0118f90a5b
- SHA1 de2fd7498ef56cf5fa916e31b3d9626c05847046
- SHA512 2b2916e0de2286697528f6318566bbc82c73347f75b958097a3cf38d6c6387b3c0a37afc07541de449ba2ec8591ef56fd395978aef4ec8277078db6fc519c2ca
- SSDEEP 384:H3ixLk0rZrzKXpBrolyUM7pCDsVooSu8zQ/Ysy+++O5VMdrZ69UC9W+nh5:XuBFKXHNUM7pCDsooSu8zYw+++Ue+/
- TLSH T139B239109E3884B5D6620EBD74575FA38C6E43B3DBD550E3EF63ECE858309C2887961A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Sniperscan\sniperscan.exe
- Size 1.2MB
- SHA256 399eb5c969a57bf12514ca625d86692dbd899cf3c3b0e4cce8b00e732bfd7e35
- MD5 815eea08ff25a95b1def0151fe3f5e07
- SHA1 10206b3a302366b60c01b57960ed8e2158ad7680
- SHA512 acb640adeacf0dea4dd1b692416778788917c147b029d78dfb39cdb0b23f41fbee3d6bb8e439961147c8fb57c02c16a415c69278116442d91ad21510b28b7a57
- SSDEEP 24576:azhNlI3uC1L7KfWCp2imSfhfysPvkWxitcDrUH2g+k51RvmaDWlDYqku5uLvif:azhNlI3uC1L7KfWCp2XSfhfysPvlItg7
- TLSH T1B1559E073396C0E9DF6B80B6CA295223E772741507389BDF25E04D2DEF93AA05B7A711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Sniperscan\sniperscan.log
- Size 658B
- SHA256 3620abf735b86b598a1c63ec7013f6febb747d1201dc9d1231b07b4a72c808db
- MD5 d4653a5f127959aeccb1e74aa620dac6
- SHA1 7b4096950eaeabd63cb1dcda5eb520a5a69d54cc
- SHA512 28ac901de168697244267a7cf5c7328e5b84fd25c20db4fb6170709613af3cdb39b5e482b54140c31366df44ecf0aa8592b7f1f52492215493bbee3860c0cd7c
- TLSH T14C017D0E5D4D3571182961D81F17A53B6718E43B122BD34C395CD5587E444EB3AE3CCA
- MD5 SHA1 SHA512 TLSH
- Path C:\Sniperscan\sniperscan.log
- Size 82B
- SHA256 1ca74bb604a2e763683206e1d1a738ccc76cc9802f8f64f4862d7b01d012741a
- MD5 1dac5cb54923564e0882c18f822d16a3
- SHA1 45f6ca2e8f65b5f9b9f8a62dafac77c219c81196
- SHA512 d28e9595d473e820eaf3376dca764d4548b44bd657af30b16e5157e6f86f24f38e6801e1fd26eb0a2c7df44398d18fcdaa7910b1d7c42886205383c55e0bc826
- TLSH T1B3A00403054C11D17D0107D31F11470C50D35035001FD1147504705F30115430F03C00
- MD5 SHA1 SHA512 TLSH
- Path C:\Sniperscan\sniperscanengine.exe
- Size 213KB
- SHA256 c49093a68d49165a5b6c1284cd42c448032616439f530563af405b8c373854e1
- MD5 ccdd18f654f36670eb9c0fe0226517d3
- SHA1 8350e267898f39d0648bfddfaf7a2f5d8d2b55a5
- SHA512 b56cee965f1202268fe207f40b013d9d4e7226af082d5cb8921f24acc87708c1d96c3eb063750b469d31ae8999aee1f685ad6c70c8a03beae13674f93e1ddf11
- SSDEEP 6144:CZC4d3lbxc6wU/UP+XhdMRFD3LAwektooSW5:b4dMRU/UP4heFjLDFtooSq
- TLSH T15124122FD71EA02EED38233187675A18A124AD2D4C744CB9A1833D6F7737B5EC84E259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Sniperscan\sniperscanengine.log
- Size 200B
- SHA256 dd22f31b757dfcc7e6f81bd62cf2bae0da8097493629c12d31b51d8716795711
- MD5 c584114ce8326bbd3c8b2e3a5802ec9f
- SHA1 8047b7ec2cbc6362263f7382afb84fc458bbab60
- SHA512 808f83683ec470920fe5d430cf6b0421a9fb7e23cf32e71c90d06736172b25ee457f29947fa558f10cd4393d22fa236f53be8e400a3fb65b4872f39a1f7e0659
- MD5 SHA1 SHA512
- Path C:\Sniperscan\sniperscanengine.log
- Size 540B
- SHA256 f33d53b466d42aa6770b7a2ee5bbf87890267d990fcfe24d14b7bac7b15cf827
- MD5 400e2c84c1047534bd1994038d4e1a3d
- SHA1 539af2400971d969bb274dd515f643d33fd0f25a
- SHA512 837b17470859d092c879bf087a862459bd595fc00cc3ad0ff9bee51fac048e3f09cf486223974ceeba57505068adbb7bac4b0919e096eb534f19b9be86ef4910
- TLSH T13FF0324B0C00B03A2203C00E388302B0C233C0728A03000028AAC828FCB0FAEFB8F2CF
- MD5 SHA1 SHA512 TLSH
- Path C:\Sniperscan\update\deleteme.txt
- Size 4B
- SHA256 3f26db74530b33f768d325a7ee5e213495ae18eb97a724c6a6db578f65a74318
- MD5 8b8ab6f8a6202b5ad3f9cf85ab4eaaa0
- SHA1 0dabd2d82cd31505293025d84b06dc709200b0a1
- SHA512 9d4dd7fc863f553f897bbfdaf7349e60dc5feea422725274dd54d1d62f1e3b738e9c676ca8eaa30209334023e6519676658d33d6a27b2a763d222d846a26e862
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\nsuDAB7.tmp\System.dll
- Size 11KB
- SHA256 484f8e9f194ed9016274ef3672b2c52ed5f574fb71d3884edf3c222b758a75a2
- MD5 960a5c48e25cf2bca332e74e11d825c9
- SHA1 da35c6816ace5daf4c6c1d57b93b09a82ecdc876
- SHA512 cc450179e2d0d56aee2ccf8163d3882978c4e9c1aa3d3a95875fe9ba9831e07ddfd377111dc67f801fa53b6f468a418f086f1de7c71e0a5b634e1ae2a67cd3da
- SSDEEP 192:jVL7iZJX76BiqsO7+UZEw+RlthVEoC0O3XB:g7ssOpZs/hS3X
- TLSH T19A323918036442F3E5D5C83D186A3BAB5B28252196F08F53DFB39881FE386D66D39362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\ins.tx
- Size 10B
- SHA256 fa17253528be2e155506f8e739d6a4847e67cc4f4b854619fe2f5b636ac809ba
- MD5 311948e6ed35be9d6e21db22ee8b0b16
- SHA1 3a623e9fc7bfc5f732db897bbbd66ec404efcaff
- SHA512 aee00371d90f7d986539accffc66aa67eba29a4157d1dfad45810b5ee3d345a6621e69350d1c1779fcf0adfe8a1053484c13734950d3625072110fbadfe59721
- MD5 SHA1 SHA512