Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 18:39
Static task
static1
Behavioral task
behavioral1
Sample
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe
-
Size
2.2MB
-
MD5
b49cd0398cbc0e6cdfbab13cf0e53773
-
SHA1
565694a2ceb2ebbe0a49981c11adeb5cde244e76
-
SHA256
6e04fdd174b6d18769751acb97564e41b131ec95e00e9d92152f52969113b547
-
SHA512
32015420e4cb24c1d59de76e05fb8885069a8ef69dc7ab5bf60def9de503e7b6a7c78771b83b620eeb32b07e9173d10c267a237db62c55d19536761589528349
-
SSDEEP
49152:Es9J0weFq3/+GSoZxNqPaNQN64vjLFn1XA2mk/U:EkRHdZOPaNQnvjLF1P8
Malware Config
Extracted
F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\FTCPWBHEC-DECRYPT.txt
http://gandcrabmfe6mnef.onion/1edef952f3001c0
Signatures
-
Gandcrab
Gandcrab is a Trojan horse that encrypts files on a computer.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe -
Renames multiple (276) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe -
Drops startup file 2 IoCs
Processes:
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\FTCPWBHEC-DECRYPT.txt b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\f30062df3001c0718.lock b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Wine b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exedescription ioc process File opened (read-only) \??\G: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\J: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\M: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\R: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\U: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\X: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\A: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\H: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\K: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\N: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\O: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\B: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\I: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\Q: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\S: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\Y: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\W: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\Z: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\E: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\L: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\P: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\T: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened (read-only) \??\V: b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\pidor.bmp" b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exedescription pid process target process PID 4060 set thread context of 4884 4060 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe -
Drops file in Program Files directory 26 IoCs
Processes:
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exedescription ioc process File created C:\Program Files\f30062df3001c0718.lock b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\CompressCheckpoint.tiff b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\ConvertToJoin.clr b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\ImportPop.MTS b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\ReceiveRevoke.png b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\RestartFind.ttf b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\ResumeRename.edrwx b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\StartSubmit.otf b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\CloseFind.mpv2 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\DenyCheckpoint.nfo b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\TraceUnlock.mov b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File created C:\Program Files\FTCPWBHEC-DECRYPT.txt b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\ApproveUninstall.xlsb b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\WaitUnprotect.gif b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File created C:\Program Files (x86)\FTCPWBHEC-DECRYPT.txt b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\CloseUnlock.emf b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\ResizeGrant.bmp b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\ResumeUnpublish.AAC b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\UnlockInstall.html b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\EnableFormat.vssm b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\PublishSubmit.mpg b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File created C:\Program Files (x86)\f30062df3001c0718.lock b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\BackupSkip.zip b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\FormatWatch.mpeg b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\GroupRestart.jpg b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe File opened for modification C:\Program Files\PushWrite.docx b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe -
Processes:
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B51C067CEE2B0C3DF855AB2D92F4FE39D4E70F0E\Blob = 5c0000000100000004000000000800000b000000010000005400000053007400610072006600690065006c006400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f007200690074007900200013202000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c06200000001000000200000002ce1cb0bf9d2f9e102993fbe215152c3b2dd0cabde1c68e5319b839154dbb7f51400000001000000140000007c0c321fa7d9307fc47d68a362a8a1ceab075b271d000000010000001000000054e2cd85ba79cda018fed9e6a863aa46030000000100000014000000b51c067cee2b0c3df855ab2d92f4fe39d4e70f0e2000000001000000e1030000308203dd308202c5a003020102020100300d06092a864886f70d01010b050030818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a30818f310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e3132303006035504031329537461726669656c6420526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bdedc103fcf68ffc02b16f5b9f48d99d79e2a2b703615618c347b6d7ca3d352e8943f7a1699bde8a1afd13209cb44977322956fdb9ec8cdd22fa72dc276197eef65a84ec6e19b9892cdc845bd574fb6b5fc589a51052894655f4b8751ce67fe454ae4bf85572570219f8177159eb1e280774c59d48be6cb4f4a4b0f364377992c0ec465e7fe16d534c62afcd1f0b63bb3a9dfbfc7900986174cf26824063f3b2726a190d99cad40e75cc37fb8b89c159f1627f5fb35f6530f8a7b74d765a1e765e34c0e89656998ab3f07fa4cdbddc32317c91cfe05f11f86baa495cd19994d1a2e3635b0976b55662e14b741d96d426d4080459d0980e0ee6defcc3ec1f90f10203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147c0c321fa7d9307fc47d68a362a8a1ceab075b27300d06092a864886f70d01010b050003820101001159fa254f036f94993b9a1f828539d47605945ee128936d625d09c2a0a8d4b07538f1346a9de49f8a862651e62cd1c62d6e95204a9201ecb88a677b31e2672e8c9503262e439d4a31f60eb50cbbb7e2377f22ba00a30e7b52fb6bbb3bc4d379514ecd90f4670719c83c467a0d017dc558e76de68530179a24c410e004f7e0f27fd4aa0aff421d37ed94e5645912207738d3323e3881759673fa688fb1cbce1fc5ecfa9c7ecf7eb1f1072db6fcbfcaa4bfd097054abcea18280290bd5478092171d3d17d1dd916b0a9613dd00a0022fcc77bcb0964450b3b4081f77d7c32f598ca588e7d2aee90597364f936745e25a1f566052e7f3915a92afb508b8e8569f4 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exepid process 4884 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe 4884 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe 4884 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe 4884 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
wmic.exevssvc.exedescription pid process Token: SeIncreaseQuotaPrivilege 844 wmic.exe Token: SeSecurityPrivilege 844 wmic.exe Token: SeTakeOwnershipPrivilege 844 wmic.exe Token: SeLoadDriverPrivilege 844 wmic.exe Token: SeSystemProfilePrivilege 844 wmic.exe Token: SeSystemtimePrivilege 844 wmic.exe Token: SeProfSingleProcessPrivilege 844 wmic.exe Token: SeIncBasePriorityPrivilege 844 wmic.exe Token: SeCreatePagefilePrivilege 844 wmic.exe Token: SeBackupPrivilege 844 wmic.exe Token: SeRestorePrivilege 844 wmic.exe Token: SeShutdownPrivilege 844 wmic.exe Token: SeDebugPrivilege 844 wmic.exe Token: SeSystemEnvironmentPrivilege 844 wmic.exe Token: SeRemoteShutdownPrivilege 844 wmic.exe Token: SeUndockPrivilege 844 wmic.exe Token: SeManageVolumePrivilege 844 wmic.exe Token: 33 844 wmic.exe Token: 34 844 wmic.exe Token: 35 844 wmic.exe Token: 36 844 wmic.exe Token: SeIncreaseQuotaPrivilege 844 wmic.exe Token: SeSecurityPrivilege 844 wmic.exe Token: SeTakeOwnershipPrivilege 844 wmic.exe Token: SeLoadDriverPrivilege 844 wmic.exe Token: SeSystemProfilePrivilege 844 wmic.exe Token: SeSystemtimePrivilege 844 wmic.exe Token: SeProfSingleProcessPrivilege 844 wmic.exe Token: SeIncBasePriorityPrivilege 844 wmic.exe Token: SeCreatePagefilePrivilege 844 wmic.exe Token: SeBackupPrivilege 844 wmic.exe Token: SeRestorePrivilege 844 wmic.exe Token: SeShutdownPrivilege 844 wmic.exe Token: SeDebugPrivilege 844 wmic.exe Token: SeSystemEnvironmentPrivilege 844 wmic.exe Token: SeRemoteShutdownPrivilege 844 wmic.exe Token: SeUndockPrivilege 844 wmic.exe Token: SeManageVolumePrivilege 844 wmic.exe Token: 33 844 wmic.exe Token: 34 844 wmic.exe Token: 35 844 wmic.exe Token: 36 844 wmic.exe Token: SeBackupPrivilege 4892 vssvc.exe Token: SeRestorePrivilege 4892 vssvc.exe Token: SeAuditPrivilege 4892 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exeb49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exedescription pid process target process PID 4060 wrote to memory of 4884 4060 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe PID 4060 wrote to memory of 4884 4060 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe PID 4060 wrote to memory of 4884 4060 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe PID 4060 wrote to memory of 4884 4060 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe PID 4060 wrote to memory of 4884 4060 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe PID 4884 wrote to memory of 844 4884 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe wmic.exe PID 4884 wrote to memory of 844 4884 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe wmic.exe PID 4884 wrote to memory of 844 4884 b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe wmic.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b49cd0398cbc0e6cdfbab13cf0e53773_JaffaCakes118.exe"2⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wbem\wmic.exe"C:\Windows\system32\wbem\wmic.exe" shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:81⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Defense Evasion
Indicator Removal
1File Deletion
1Virtualization/Sandbox Evasion
2Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
F:\$RECYCLE.BIN\S-1-5-21-3808065738-1666277613-1125846146-1000\FTCPWBHEC-DECRYPT.txtFilesize
8KB
MD5e37d7be0823e2167f6ba218228826348
SHA19daa232c4fca4306ad5ad77caa91d03758147b2f
SHA256738c32e47ca481d9733df410399a5ce4610809e123a04e9e42b0eb1915203662
SHA512c2c3e3c4c19aed57618783c1819cc2b086ef2ce62d11d43e9721047bf03b33fdbb4d6e01ca5be519508a0ec782ecec8bfae6174e1c0ad88ab0e885512522b0ca
-
memory/4060-20-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-29-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-3-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-4-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-5-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-6-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-19-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-8-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-9-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-10-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-11-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-12-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-13-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-14-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-15-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-16-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-17-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-21-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-7-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-1-0x0000000000401000-0x000000000043E000-memory.dmpFilesize
244KB
-
memory/4060-18-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-22-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-23-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-24-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-25-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-27-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-26-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-28-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-2-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-30-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-0-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4060-35-0x0000000000400000-0x000000000092C000-memory.dmpFilesize
5.2MB
-
memory/4884-33-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4884-32-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4884-31-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4884-36-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4884-46-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4884-748-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4884-750-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4884-751-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB