modiloader | 76081536605f54e193127ce89901ec20dcb94782cc4c28a8c2cfb58521b23bf4

Analysis

max time kernel
149s
max time network
128s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 02:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
Size

875KB
MD5

18669652b47dc9bbacea0b790bc47e1c
SHA1

6b852f8c039052bfd7f5c94b486c4e7c040a8077
SHA256

76081536605f54e193127ce89901ec20dcb94782cc4c28a8c2cfb58521b23bf4
SHA512

d1023c4c071240b1ca01da705eeb83f7b4bd17adfa658982326cc293ee80f1a088b5c1adab7fbce4f24ce5189443e3901df98c786abd7cf2f0427ecc278f60ec
SSDEEP

24576:B5T0kUJQCdHVFQlyOW8oooiAhYJWtA7q:B53UVHVFQAp5iAOgtAG

Score

10^/10

modiloader pony discovery evasion persistence rat spyware stealer trojan upx

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader
Modifies security service 2 TTPs 1 IoCs
evasion

Modify Registry
T1112

Windows Service
T1543.003

Processes:

cthost.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" cthost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3"	cthost.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

Ww9OoYLk.exemeaje.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	Ww9OoYLk.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	meaje.exe

Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony

ModiLoader Second Stage 9 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2984-10-0x0000000000400000-0x000000000041F000-memory.dmp	modiloader_stage2
behavioral1/memory/3040-15-0x0000000000400000-0x0000000000535000-memory.dmp	modiloader_stage2
behavioral1/memory/3040-14-0x0000000000400000-0x0000000000535000-memory.dmp	modiloader_stage2
\Users\Admin\athost.exe	modiloader_stage2
behavioral1/memory/2580-69-0x0000000000400000-0x000000000041E000-memory.dmp	modiloader_stage2
\Users\Admin\bthost.exe	modiloader_stage2
behavioral1/memory/2856-89-0x0000000000400000-0x000000000041E000-memory.dmp	modiloader_stage2
behavioral1/memory/3040-153-0x0000000000400000-0x0000000000535000-memory.dmp	modiloader_stage2
behavioral1/memory/3040-360-0x0000000000400000-0x0000000000535000-memory.dmp	modiloader_stage2

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
persistence

Active Setup
T1547.014

Modify Registry
T1112

Processes:

explorer.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe
Disables taskbar notifications via registry modification
evasion
Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1680 cmd.exe
Executes dropped EXE 13 IoCs

Processes:

Ww9OoYLk.exemeaje.exeathost.exeathost.exebthost.exebthost.execthost.exedthost.execsrss.execthost.exeethost.execthost.exe99CF.tmp

pid process

2344 Ww9OoYLk.exe
2772 meaje.exe
2580 athost.exe
3056 athost.exe
2856 bthost.exe
2620 bthost.exe
1796 cthost.exe
2792 dthost.exe
332 csrss.exe
1300 cthost.exe
1708 ethost.exe
1680 cthost.exe
2556 99CF.tmp

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

pid	process
1680	cmd.exe

Loads dropped DLL 19 IoCs

Processes:

18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exeWw9OoYLk.execthost.exeDllHost.exe99CF.tmp

pid	process
3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
2344	Ww9OoYLk.exe
2344	Ww9OoYLk.exe
3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
1796	cthost.exe
2180	DllHost.exe
3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
1796	cthost.exe
1796	cthost.exe
2556	99CF.tmp

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/3040-3-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral1/memory/3040-2-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral1/memory/3040-13-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral1/memory/3040-6-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral1/memory/3040-15-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral1/memory/3040-14-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral1/memory/2620-94-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2620-93-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2620-92-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2620-87-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2620-83-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/2620-81-0x0000000000400000-0x0000000000427000-memory.dmp	upx
behavioral1/memory/1300-148-0x0000000000400000-0x000000000046B000-memory.dmp	upx
behavioral1/memory/3040-153-0x0000000000400000-0x0000000000535000-memory.dmp	upx
behavioral1/memory/3040-360-0x0000000000400000-0x0000000000535000-memory.dmp	upx

Adds Run key to start application 2 TTPs 54 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

meaje.execthost.exeWw9OoYLk.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /l"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /c"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /e"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /E"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /X"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /b"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /O"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /W"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /D"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /w"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /g"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /L"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /r"	meaje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\D63.exe = "C:\\Program Files (x86)\\LP\\C4CE\\D63.exe"	cthost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /U"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /o"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /h"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /K"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /q"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /T"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /G"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /F"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /J"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /t"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /H"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /y"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /x"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /B"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /m"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /k"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /n"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /a"	Ww9OoYLk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /P"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /Q"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /v"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /f"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /R"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /Y"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /A"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /N"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /d"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /C"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /s"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /V"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /I"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /M"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /p"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /S"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /z"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /j"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /i"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /Z"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /a"	meaje.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\meaje = "C:\\Users\\Admin\\meaje.exe /u"	meaje.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Drops desktop.ini file(s) 2 IoCs

Processes:

csrss.exe

description ioc process

File created \systemroot\assembly\GAC_64\Desktop.ini csrss.exe
File created \systemroot\assembly\GAC_32\Desktop.ini csrss.exe

description	ioc	process
File created	\systemroot\assembly\GAC_64\Desktop.ini	csrss.exe
File created	\systemroot\assembly\GAC_32\Desktop.ini	csrss.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

athost.exebthost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	athost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	bthost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	bthost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	athost.exe

Suspicious use of SetThreadContext 4 IoCs

Processes:

18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exeathost.exebthost.exedthost.exe

description	pid	process	target process
PID 2984 set thread context of 3040	2984	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
PID 2580 set thread context of 3056	2580	athost.exe	athost.exe
PID 2856 set thread context of 2620	2856	bthost.exe	bthost.exe
PID 2792 set thread context of 2080	2792	dthost.exe	cmd.exe

Drops file in Program Files directory 3 IoCs

Processes:

cthost.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\LP\C4CE\D63.exe	cthost.exe
File created	C:\Program Files (x86)\LP\C4CE\D63.exe	cthost.exe
File opened for modification	C:\Program Files (x86)\LP\C4CE\99CF.tmp	cthost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 2 IoCs

Process Discovery
T1057

Processes:

tasklist.exetasklist.exe

pid process

2540 tasklist.exe
2800 tasklist.exe

pid	process
2540	tasklist.exe
2800	tasklist.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Ww9OoYLk.exeathost.exebthost.exemeaje.execthost.exedthost.exe

pid	process
2344	Ww9OoYLk.exe
2344	Ww9OoYLk.exe
3056	athost.exe
3056	athost.exe
3056	athost.exe
2620	bthost.exe
2772	meaje.exe
1796	cthost.exe
1796	cthost.exe
1796	cthost.exe
1796	cthost.exe
1796	cthost.exe
1796	cthost.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2792	dthost.exe
2792	dthost.exe
2792	dthost.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
3056	athost.exe
3056	athost.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
3056	athost.exe
3056	athost.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
3056	athost.exe
3056	athost.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
3056	athost.exe
3056	athost.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
2772	meaje.exe
3056	athost.exe
3056	athost.exe
2772	meaje.exe
2772	meaje.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

1188 explorer.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

Processes:

tasklist.exemsiexec.exedthost.exeexplorer.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	2540	tasklist.exe
Token: SeRestorePrivilege	2588	msiexec.exe
Token: SeTakeOwnershipPrivilege	2588	msiexec.exe
Token: SeSecurityPrivilege	2588	msiexec.exe
Token: SeDebugPrivilege	2792	dthost.exe
Token: SeDebugPrivilege	2792	dthost.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeShutdownPrivilege	1188	explorer.exe
Token: SeDebugPrivilege	2800	tasklist.exe

Suspicious use of FindShellTrayWindow 28 IoCs

Processes:

explorer.exe

pid	process
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

explorer.exe

pid	process
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe
1188	explorer.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exeWw9OoYLk.exemeaje.exeethost.exe

pid process

3040 18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
2344 Ww9OoYLk.exe
2772 meaje.exe
1708 ethost.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

csrss.exe

pid process

332 csrss.exe

pid	process
332	csrss.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exeWw9OoYLk.execmd.exeathost.exebthost.exedthost.execthost.execsrss.exe

description	pid	process	target process
PID 2984 wrote to memory of 3040	2984	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
PID 2984 wrote to memory of 3040	2984	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
PID 2984 wrote to memory of 3040	2984	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
PID 2984 wrote to memory of 3040	2984	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
PID 2984 wrote to memory of 3040	2984	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
PID 2984 wrote to memory of 3040	2984	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
PID 2984 wrote to memory of 3040	2984	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
PID 2984 wrote to memory of 3040	2984	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
PID 3040 wrote to memory of 2344	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	Ww9OoYLk.exe
PID 3040 wrote to memory of 2344	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	Ww9OoYLk.exe
PID 3040 wrote to memory of 2344	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	Ww9OoYLk.exe
PID 3040 wrote to memory of 2344	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	Ww9OoYLk.exe
PID 2344 wrote to memory of 2772	2344	Ww9OoYLk.exe	meaje.exe
PID 2344 wrote to memory of 2772	2344	Ww9OoYLk.exe	meaje.exe
PID 2344 wrote to memory of 2772	2344	Ww9OoYLk.exe	meaje.exe
PID 2344 wrote to memory of 2772	2344	Ww9OoYLk.exe	meaje.exe
PID 2344 wrote to memory of 2800	2344	Ww9OoYLk.exe	cmd.exe
PID 2344 wrote to memory of 2800	2344	Ww9OoYLk.exe	cmd.exe
PID 2344 wrote to memory of 2800	2344	Ww9OoYLk.exe	cmd.exe
PID 2344 wrote to memory of 2800	2344	Ww9OoYLk.exe	cmd.exe
PID 2800 wrote to memory of 2540	2800	cmd.exe	tasklist.exe
PID 2800 wrote to memory of 2540	2800	cmd.exe	tasklist.exe
PID 2800 wrote to memory of 2540	2800	cmd.exe	tasklist.exe
PID 2800 wrote to memory of 2540	2800	cmd.exe	tasklist.exe
PID 3040 wrote to memory of 2580	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	athost.exe
PID 3040 wrote to memory of 2580	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	athost.exe
PID 3040 wrote to memory of 2580	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	athost.exe
PID 3040 wrote to memory of 2580	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	athost.exe
PID 2580 wrote to memory of 3056	2580	athost.exe	athost.exe
PID 2580 wrote to memory of 3056	2580	athost.exe	athost.exe
PID 2580 wrote to memory of 3056	2580	athost.exe	athost.exe
PID 2580 wrote to memory of 3056	2580	athost.exe	athost.exe
PID 2580 wrote to memory of 3056	2580	athost.exe	athost.exe
PID 2580 wrote to memory of 3056	2580	athost.exe	athost.exe
PID 2580 wrote to memory of 3056	2580	athost.exe	athost.exe
PID 2580 wrote to memory of 3056	2580	athost.exe	athost.exe
PID 2580 wrote to memory of 3056	2580	athost.exe	athost.exe
PID 2580 wrote to memory of 3056	2580	athost.exe	athost.exe
PID 3040 wrote to memory of 2856	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	bthost.exe
PID 3040 wrote to memory of 2856	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	bthost.exe
PID 3040 wrote to memory of 2856	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	bthost.exe
PID 3040 wrote to memory of 2856	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	bthost.exe
PID 2856 wrote to memory of 2620	2856	bthost.exe	bthost.exe
PID 2856 wrote to memory of 2620	2856	bthost.exe	bthost.exe
PID 2856 wrote to memory of 2620	2856	bthost.exe	bthost.exe
PID 2856 wrote to memory of 2620	2856	bthost.exe	bthost.exe
PID 2856 wrote to memory of 2620	2856	bthost.exe	bthost.exe
PID 2856 wrote to memory of 2620	2856	bthost.exe	bthost.exe
PID 2856 wrote to memory of 2620	2856	bthost.exe	bthost.exe
PID 2856 wrote to memory of 2620	2856	bthost.exe	bthost.exe
PID 3040 wrote to memory of 1796	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	cthost.exe
PID 3040 wrote to memory of 1796	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	cthost.exe
PID 3040 wrote to memory of 1796	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	cthost.exe
PID 3040 wrote to memory of 1796	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	cthost.exe
PID 3040 wrote to memory of 2792	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	dthost.exe
PID 3040 wrote to memory of 2792	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	dthost.exe
PID 3040 wrote to memory of 2792	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	dthost.exe
PID 3040 wrote to memory of 2792	3040	18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe	dthost.exe
PID 2792 wrote to memory of 332	2792	dthost.exe	csrss.exe
PID 1796 wrote to memory of 1300	1796	cthost.exe	cthost.exe
PID 1796 wrote to memory of 1300	1796	cthost.exe	cthost.exe
PID 1796 wrote to memory of 1300	1796	cthost.exe	cthost.exe
PID 1796 wrote to memory of 1300	1796	cthost.exe	cthost.exe
PID 332 wrote to memory of 2180	332	csrss.exe	DllHost.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

cthost.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	cthost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1"	cthost.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
PID:852

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
2⤵
PID:2832

C:\Users\Admin\AppData\Local\Temp\18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2984

C:\Users\Admin\AppData\Local\Temp\18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040

C:\Users\Admin\Ww9OoYLk.exe
C:\Users\Admin\Ww9OoYLk.exe
3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344

C:\Users\Admin\meaje.exe
"C:\Users\Admin\meaje.exe"
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2772

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del Ww9OoYLk.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2800

C:\Windows\SysWOW64\tasklist.exe
tasklist
5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Users\Admin\athost.exe
C:\Users\Admin\athost.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2580

C:\Users\Admin\athost.exe
athost.exe
4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:3056

C:\Users\Admin\bthost.exe
C:\Users\Admin\bthost.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2856

C:\Users\Admin\bthost.exe
bthost.exe
4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:2620

C:\Users\Admin\cthost.exe
C:\Users\Admin\cthost.exe
3⤵
- Modifies security service
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1796

C:\Users\Admin\cthost.exe
C:\Users\Admin\cthost.exe startC:\Users\Admin\AppData\Roaming\E6BC3\057C4.exe%C:\Users\Admin\AppData\Roaming\E6BC3
4⤵
- Executes dropped EXE
PID:1300

C:\Users\Admin\cthost.exe
C:\Users\Admin\cthost.exe startC:\Program Files (x86)\C385C\lvvm.exe%C:\Program Files (x86)\C385C
4⤵
- Executes dropped EXE
PID:1680

C:\Program Files (x86)\LP\C4CE\99CF.tmp
"C:\Program Files (x86)\LP\C4CE\99CF.tmp"
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556

C:\Users\Admin\dthost.exe
C:\Users\Admin\dthost.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe"
4⤵
PID:2080

C:\Users\Admin\ethost.exe
C:\Users\Admin\ethost.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1708

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c tasklist&&del 18669652b47dc9bbacea0b790bc47e1c_JaffaCakes118.exe
3⤵
- Deletes itself
PID:1680

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2800

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
1⤵
- Loads dropped DLL
PID:2180

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1188

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:2476

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Active Setup

T1547.014

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Process Discovery

T1057

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\E6BC3\385C.6BC
Filesize
600B

MD5
63abf1ebd2e33970e193fef3954ba00f

SHA1
1ad0c10ee2dfd881ff906e260d86269e90a59920

SHA256
04bb2caaa4d284aca297f46b02325ffbdb16c705bab4a00551b9f67420288a14

SHA512
c0a0ac7480eeb0cb8fbd526c71e62936a29c591a5fb50b81a29d38961dac8eb9dd0d7668c1ae8ecef13ec4944b6bff2e68d12aaf9e7fd78b4f678d479660b2ca

Download Submit
C:\Users\Admin\AppData\Roaming\E6BC3\385C.6BC
Filesize
996B

MD5
b7dd79ebce19baea1cd5a56f0c43e276

SHA1
c99646384c64768ae0eec19590c88613ea5f5fc0

SHA256
cb16fd7b894a7b5f4dd10f6766e11b3dde9fdf149f74bc5cf179fbb7f0c6a07c

SHA512
47c1b08090ad1d74f6f47b62fd76a2dfde351e1fbe5db6d5938d8f4491ef411ae70ca0e308be04808f17b7ebb6c1e1e68ed677e89a4fcdc62a6bf60b9ed2cdb0

Download Submit
C:\Users\Admin\AppData\Roaming\E6BC3\385C.6BC
Filesize
1KB

MD5
ec802eb95a623352b878c28f6eafb9aa

SHA1
1bb28bad5f0a3c193a1267ab8143541708a02e7d

SHA256
b086dfdea24cff4fbc19231aea0ce238e578a754d17d84153a0e41d4c7172a16

SHA512
a7aa7b614e0dff67760618bf96cb05c12fddce0a87b4f45263b0859d7fcd04b8b15afd9ca8c7f465db587b51dad21f82444e02b22513f75e75e35066c33fe7fd

Download Submit
\??\globalroot\systemroot\assembly\temp\@
Filesize
2KB

MD5
c16dc29d91b5b1c157c7d2c4345026c7

SHA1
c3f452539e22f5dd277e293cfd0bd7dbac353cc0

SHA256
849d13f1c9cfb30832d3e449ede1203d3cca347669e15b8d084324ec1054424f

SHA512
f864d20ee5cd8acd1d0e6a89f3e36ef9b1b645f93f36036686a4815b78d2a65f08afe8cee18a4161c3a9717b041a48f949af1cc0110b64703db76c43558a2705

Download Submit
\Program Files (x86)\LP\C4CE\99CF.tmp
Filesize
95KB

MD5
a1d80ed250788260ffd66258555a4876

SHA1
10b81c2cdc4a7d645f9058c220587fac79281351

SHA256
d4d9a7028cda13828d7a6796dd12369ab1d4af80946776aa5b5c0369dd322fb3

SHA512
fee72d46425a0c1f755de2e34ad742ff579a86b2a3bff3485a15ddcbcf55d60c6297bb588650a9a673aa0a5e8f35f1ae0bc1a454154d26848c49cab700d7e5d8

Download Submit
\Users\Admin\Ww9OoYLk.exe
Filesize
256KB

MD5
77e425fe955cbc4b6245cf8a3ed645b3

SHA1
921dad95a28283f2138e8c36d4cbf295572d33ac

SHA256
86b35dd61f186218356ecced37723e647b612cb8c44ef904917f4c783e424809

SHA512
ee0a6ac25c021baf6974a23afd999bcdd519da465ee849ebd52d99ff437812165650fe8f05e5ff72f6eadf8d5a44d5c7c73853e4d5e00f8fbab45444fd56a44b

Download Submit
\Users\Admin\athost.exe
Filesize
263KB

MD5
6b7d559166467ef651497836feef65e3

SHA1
9edda6cd07a1960ba52abe17fc7402ff93d44ce6

SHA256
6151ab998d7821e147551b5ff24b11d3194c207c3ff8322fe2e2860a8b978bb0

SHA512
d58ddfe8ce3b9f4092d554713502065c351a46251ff0ce126dd05528771cd727bf636f15a4c76224d8db22117234d39b1a2bf8030b55aadcf98087a5a1814356

Download Submit
\Users\Admin\bthost.exe
Filesize
153KB

MD5
f28e94ce33674d8cf13f31bb5f20f745

SHA1
e79332b18af7b31caa195956c23303d35c2808c8

SHA256
42f40ac82f47f4eb009dbd11d7233ed2e67f80392dd4fa770faa68dd973ded2f

SHA512
8bcb1311302bbf1b6cfbbb863cffa95d5934c9bfc613cd2dc2abd425fe39ad2ec9cae7dca1e5b60d2acec4c9d422a35aeb5ab7b0433f25c01202ab3b4ca96112

Download Submit
\Users\Admin\cthost.exe
Filesize
278KB

MD5
d0bf4ea3b6fc02afd2c6ed5f4b0d142e

SHA1
2187968df184c18f945497dd410f90f4b6ff186d

SHA256
3c7ee6117b9c2e39593f452e163f16334ab1b9196b5b5616c9ff7496bb4676a0

SHA512
e0efb8672a81a8aa6c11a0f1f871033b10c6a5c6b28d30eab4f8ef7509fca8710c417b9cbbbf7844888f02858295304c23bf217e41d157e2bed594a39c2641f4

Download Submit
\Users\Admin\dthost.exe
Filesize
227KB

MD5
d39d17b38909180b0c65cb4081154100

SHA1
b7a11d389d940273b91dd9ddb11137404eedceea

SHA256
590aaa3add5efffd271c2b9cfc10fc304faf6caf83f2f9dd494a40a35b1053d3

SHA512
5a0ccc785b15e92d38bf1436522dbe81645d2b16093f20f09dfd81602e9f496693a6b27a62f88e50cdf027147b89a21db1e15532d0d4e7c2fd65710ee2071fa6

Download Submit
\Users\Admin\ethost.exe
Filesize
24KB

MD5
b38b2a8c25efb39b245dbfa6c1ccc29b

SHA1
62fda766006bfbccbfaade649ceb29764c216ea4

SHA256
1fee129dadbd67f7fab68c8fa285b5da0141785100b35bc7b66d55b10d24364d

SHA512
8cdbb4e9404783ad4a2665a05a1e64e8ab393689c2425834e854933f58904910e248dfebc57c717313abbc62105d76875ebafd206ada15417beedd58bbd7e22d

Download Submit
\Users\Admin\meaje.exe
Filesize
256KB

MD5
4f9b7314543e88009f3c91507b693bf3

SHA1
205da2d04a87f6a798c67e16a4b0055b7c673933

SHA256
b256ddf8867690ddb66932ae28de75413f958c3eff3f05a2ce3c3809f11898d4

SHA512
1d062d3e29cec1aafcf945143235855aa59bfbe0c6ce4f11c8a51adcfddec6247fbffcb7b6353236527b7136d71e47c55490537f5010e3d7c7c3a2179537f5bb

Download Submit
\Windows\System32\consrv.dll
Filesize
53KB

MD5
63e99b675a1337db6d8430195ea3efd2

SHA1
1baead2bf8f433dc82f9b2c03fd65ce697a92155

SHA256
6616179477849205eb4075b75a042056d196f45d67f78929dbb3317a35ccbea9

SHA512
f5b986eafa38dbc9ad7759784ac887ecbb9c8d8009a3f33e91b9c9ceeaf043ed3e4ddab8e6b6b77e54aed9fcecab02442c8ff253f2136ea06996d05ddd68199f

Download Submit
\Windows\assembly\GAC_32\Desktop.ini
Filesize
4KB

MD5
758f90d425814ea5a1d2694e44e7e295

SHA1
64d61731255ef2c3060868f92f6b81b4c9b5fe29

SHA256
896221147d8172197cbbf06c45d461141ce6b4af38027c1a22d57c1165026433

SHA512
11858e498309f611ee6241c026a402d6d979bffe28d4cbf7c9d5a89c3f3de25e1d253ab552ef7bc7cc43dd056307bd625e2e4f09beb21f0214c3946113b97ca9

Download Submit
\Windows\assembly\GAC_64\Desktop.ini
Filesize
5KB

MD5
92f9cdae857253a3895faffa85b3d8b9

SHA1
d28352ff5a02eeb98334e3d0f845a259b2aacff3

SHA256
5653db84679ab49eec2e32127271dacd802b8ed53a5199c5fd5fe998be32a36b

SHA512
f23ec0a005b5d84d26527cd6c26d494b9ecff4b099adfd780fe7953f5affb0f295f92dc663d79bcb60d42f82d249b7e61acb39a38bdbd66185da5bf6126737a6

Download Submit
memory/332-132-0x00000000023C0000-0x00000000023D2000-memory.dmp

Filesize
72KB

Download
memory/1300-148-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/2580-69-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2620-92-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2620-81-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2620-83-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2620-79-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2620-87-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2620-94-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2620-93-0x0000000000400000-0x0000000000427000-memory.dmp

Filesize
156KB

Download
memory/2792-124-0x0000000002110000-0x0000000002155000-memory.dmp

Filesize
276KB

Download
memory/2792-118-0x0000000002110000-0x0000000002155000-memory.dmp

Filesize
276KB

Download
memory/2792-152-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2792-126-0x0000000002110000-0x0000000002155000-memory.dmp

Filesize
276KB

Download
memory/2792-113-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2792-123-0x0000000002110000-0x0000000002155000-memory.dmp

Filesize
276KB

Download
memory/2792-114-0x0000000002110000-0x0000000002155000-memory.dmp

Filesize
276KB

Download
memory/2792-122-0x0000000002110000-0x0000000002155000-memory.dmp

Filesize
276KB

Download
memory/2856-89-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2984-10-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3040-6-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/3040-13-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/3040-112-0x00000000005B0000-0x0000000000616000-memory.dmp

Filesize
408KB

Download
memory/3040-0-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/3040-3-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/3040-111-0x00000000005B0000-0x0000000000616000-memory.dmp

Filesize
408KB

Download
memory/3040-360-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/3040-2-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/3040-14-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/3040-15-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/3040-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3040-153-0x0000000000400000-0x0000000000535000-memory.dmp

Filesize
1.2MB

Download
memory/3056-62-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3056-163-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3056-54-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3056-56-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3056-66-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3056-53-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3056-70-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/3056-59-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download