exorcist | dfecb46078038bcfa9d0b8db18bdc0646f33bad55ee7dd5ee46e61c6cf399620

General

Target

Setup.exe
Size

68KB
MD5

9e5c89c84cdbf460fc6857c4e32dafdf
SHA1

ee0a95846ce48c59261eda0fdd6b38dfc83d9f4d
SHA256

dfecb46078038bcfa9d0b8db18bdc0646f33bad55ee7dd5ee46e61c6cf399620
SHA512

6da517ae5159ebcb0ac138b34215924fb21adae619c3c15ede6863866648e445633f482b2beaddbe74de66b48e18d106dbde3253ee2d3ce86da667f7f8494cd8

Score

10^/10

ransomware persistence exorcist

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\DECRYPT-bkgdrg-decrypt.hta

Family

exorcist

Ransom Note

bkgdrg Decrypt All your data has been encrypted with Exorcist 2.0 Ransomware. Do not worry: you have some hours to contact us and decrypt your data by paying a ransom. If you don't pay in time, price will be increased. Then, if the payment is still not received, your keys will be destroyed. To do this, install Tor Browser (here: https://www.torproject.org/download/) and follow instructions on this web site: http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/ IMPORTANT: Do not modify this file, otherwise you will not be able to recover your data! Your authorization key: HS4CNdXejjZ12VAwiBoCOd+Q+dF6uZ++gbweVOIFX3Ueo4bffx1BK/uMg2il0QE8 2SRSsOVfPqzEK4HztQc8yllM9xdmbg1W7FiZX2ZHXAvtcOdKrVGexxMiBfe/plA1 8jY96rPYycWzb7oWncGowXK7TXvhFuWjGrvSfe22rLwG6dQ7/o5Ej9dNZUOVVbFq quag7pPprpkMByb9cgsVoZgkaX4tw0zMkBeBsc8lL3DFO6XIK2Wmi2U+7RTHXxRz zDiwQ/+AeVxxUGHuauiHavsIj3ylEf+AI5aeUdCBBQGG/rl0Dsn0kpd3tZZe4oW6 dZOFW+GZRY32qUXjKHdZDMy276JgU6a4q4ZUdAzfWA2IPmIVQqady2fbu9Wdl8LN BHrdsMqs8bhmKnqu/8NNwB82rAEQK2CdpaYG2uZF9SlSQRCmwZWPnKSbl7OIQ3TQ Cg6xHlK44npW0Pds9HQpqCbbgKpnl5F/4wMew4AY6TDJCKZB/0ec3Yjgt4dJ3e8B ykcqMvkfBTulVW9IG9oNecqv9/wvVECU3eiq37rW5bVr13u3SjJO0sU6XXY8Sm9F yGru6gmB2P21Kcgdr8zi6ZBa1w0pwnYtaBvgAv+gfq/3Ceq70uYqsmfh0IhvOcMY 3/KviwHAykPGSp8Q8wQd96FQPVXH/HE9NNPJdfoNspYTNkKraSVCo3Ks/gBednPY 4kbr9vmjkD8YZL6KXvTY6cPwnqL3bMLpI7T1/9ZyqBcPB6D7DvYc2giMHCKYvfkx dOdhxa8+4a1Be1oqtZpCwJn/lW1CydSu5jhAgLKRoGmqexBqzqrkUTXZvSp3pvA4 QlaYdEy1EHeUgZcKiRN7B8SUSjalG+h0RvoPvFEePr8anG+x0cSanlv1sHOq4upT brwQg7ZXYNlEyZeTFmKTx0c1nLOkBL1JulIz8CL7A61hViDpocvj3vTEal14yazC iwL5UdxhfE+rdrgl8+/RWlA465VJqVwtAVAAwmZ1om16U9OqXUYp9mN2M/8TzuAV wlUz8+Q8NxOX2+dHehEdys7MUfhXeuN9TpgRpuQ3QxY+b0a8RHP5te7vTP0FrXL0 eUa7Mnwj+3o9MJK5LMv75WJctzFT4HkPQCbXxt9aHbTOJ5AZa7UKEsb38c1Gm2RL tVpfZo40e+HZdF3k0weo3fbBEC05vf7uSngfHHsLk6tsLg+sQLnn3wTBTlBGB46t LNxo3MkrJ6GDWlBHiOJdHfaYBtsDbTYxKxIoBrAPcrX9DscqmADHbT9MFH+EO/AJ i73Cpib7ZdTFWr+eUa6TzFyqSuAS27RN2P5w3EhrUN7uppPukjbAj9+mSjILYV1i klV7XsxeBXMYAXaL3rrtyawdJuo7koPi0V3Tsx0jsdpW3Uw+5DczCMbxrUF5nPEY NzuWuhHmDImYqKcPLCMpilL0eOj+Jt4G1iSEAlBlNujmwMdISYbsdi7hBzTIqI6V fSgXvmShGGHYwBPV4vtfyYd/YofQ98A79qVMKfuzgjD6FaeHD/3Sw5qlkuuLyaeC eLxdPvvvm2EuBXlgMEa/IIvi+nnP3ZL/QjrUMUsmR+kALt1Z1PMjbzcM/qV7oX23 Oh3ixcgRL0lN74KcspgyT5q9XV1TqdGwl/SdPU2xoXmIBTtPJiuwk/ntJ2Y7iSBw H+8WPPRzAASyNhfo2x15uocATBxyl/V0J/oV+GNe0FpNKv5iAwv58n1ZTnYkXjei zy2hmS50EnQt/475hm2po9UT6Ur1glN9qBjw/AzY51Jecr8z/wJMLpBtvfLjKo6H qB+mNSDxJcvotuPtOopt5fnZTyfLkkdEuh2gucLNallel1O87+uvlLggfu6fY5QG EOE0WnHlDVcocQ8R9og3yWQM31+uIPaEabqRIAMKzNGPhhg2fpfR0wfRnaj2/QBi iadxch7u1uJ3TMjTKHX6AiCIt0MLdWyfN+XX5JiLvJBxQ9prSJuFspsWW8eiKvwN bebFLYgWE0HuoZvu7iM4c+RbbwqbWAwsTFWUppJndX9yM6hHn+CMwOvWlu4tb7m+ 7Qk7jSsAqqF08u9ScQYGKZiXll5B6g+WWK17jSLKaSMP0tI7W2LKz6R0XYYq7bF6 ke/0MuaOgJ6XgBvggUmmI1z4axYXarOPXBo3+W+MIf8WTbsjzYKS7ctcsEfLXVEi NmXHePlsue9saV3l86LjKtwl5JZ0kzCUukFxHBLoNE8M9L5+o2cN2WekXcYAFndt 82RfYfLh8kQhiZBQDFH+Xn0Bs5e6Uot7/UjXiNEVeFwPltENXQ/mNMmxO29q+U/S kd6LXxxgFTBuyEf7hTQ1+ffE9ocprZWB9907zna2hfMd5Te00tWH+7GRG8QGEN2e 7fDvA8EFhoSQ7ZodZK+liE0D4iFL9YKoNJID76uCW9+V0EZrduOx5cSieftABf2i gv0WSjSZLOMU5LmZ+90eMEgppskdEc3kQBUAiRGYn8FzCujeDra/FXfrz21UROAg tgGW7tmsWoXSGwsQ+mpym0miGWQ+r199L0Vvvy9ohRyPDce56Rjg9IaSFalvWX8p 58ZMXLOgwbq7gtBXbsN+yaOKKCgWJHAIkXnPRJS4aVt6647UAJGASlCan4Zg50fO VYN8IeYxXcX8DM9W+j1Vkkxq5JN+UkZAavXhyM0KmxMqSid13mdKvR2gRdwCWbOC 0oj8dL35bYmhTx7NvQfPZfUJhXfFaVsN9vbGD7w8SL3caJNmnMwucN9VbhrX06Gx mgFyT/Qb+G0ZbNNvN+ENOD1rPIpeM4AktU+U8NH+VVPkGuBqInDTvfE1dGdeSmHg VS3ii3XgVlug4o9ZwZvr+MAf7PHI3rCOSvy0DGdC9N8gdT5LZ7N6ZPSo+d8lGjxQ tBR5uVxeowyJJuv5uaNLii3LptByNvZknOmpORxcn1pZrUiueWXIPCTHkcM2Cq9/ LOe8BJCDOPE+EE+V+c1ISubZFaopvu2sel8v2zBLuQnpyWHl37U0H2A2BfC8QhxE hfvCc/UZu4UKynVjZct4uPsw4WhWDwVVR2AvOeN4ukLJ0s4FExh4t2c3OUu7/ISf tAAInJmoeXRR32DI/74aoHnTNucVTKwygRNVYmw7l2gIo7x6ElemymScV8N4xmFw 4+kpEqljYYW4lnhftWt02r5zl+2v2rmC7iL/M736QV/A3bTaTeRYQq+8xMNgJGPt nJ1IPupQek+T9I/D0+h1odMQM5IouK/18xHdmFNCgLymYYWf5imzUNg4qPw2Jijd b0F2guG462nSl2TaVZe25MS7TYJVnEGHSZGQNMhYMJjYYZN3yZgNzVrUQ8q3bK+/ a3LIyd9bD5+KRH8u3EddmivyY/zmLpW47k9Ae8OOAft4+QLEfi45aLPG0eu5ZLRV oh0QThGc0pIU9H076JL1nxsWGFCEB8TtmUt+7Db5nMORC6zHzLy61/I6kEFDrUfT zd4J/2XrGIf8CUPFnQIhoto7a4Gk+3XtpCSHSAr9yzMtUcU4el6DYgZqyY7EW8NR 92tCZ4prGDDOkAWGG9UyrEcmi2gtBaNk7Ih+ikQiZcOacKHDt0wO+ap4fNniGlaW KiiClER8djgbhxdqS3ExSG3FUKwOauXuHyfppTkXErnnpWx6Dc1XytcpPScPhEFO R/WspwiPIZA3epQVTvkeS9/yQDDOHNaNYg4Kzr4++wGrYTl4aTsxyE9I+QBqpPjP iUsdtJy5PcrD/yh52BCPKytU8VzC9bJPsXB8vQfU1Z2ZlBzq2w7iiEcxeKIV61GW 3nJwJwFdKex3uAt7bIHjRtWhhI3lxK2E3jiOlh81aRI0+xIcXJRUcjjchnXKOFXV LV5udzPYPtDrMkH9L1VkaThbe669wc0XAwYJHoNSq9dJHX9xWmZ+EZX2Nq5H/lNb vHR6kkQ2S7nvaI06LbNAarTYJAoDI7VmO4hrO1eAyCBj7HKVHmgdY9H9gbmKFHLb B8hynxM3RK+9cVLkLESlfK61vU8kUckfvONEd/8RLsPjT5k0OICQfG1102vQRi/t jFSE5gPsjjtCEUeJj2pHdxxIQYj6qeGeCD8sOl0U7HrqRsz0CQfeTXi6VjruyC0B V8rHFBCKAIgzLh7ZtegSvhCwK+2lrFnFL2G5e9B+/u0FTsc8HP1O9bjwXjA5UcG5 F+CNGGBUcU2MWM/Y9XvCOzqs92TH3pPrdx00TXwEOOfXAPxQiM6/ntDQTn/21FLg iL7iYzPIk7v760OgC4/V4u3y2jcWHfcPiuI/Mhas2vDEUKaZ0iKqCuBFXFMdXff7 Npq7sNMdWid9tdDrtwAhhMXwiWZD8OrqH9g4LKdnxDAuVvXMxSfywUhxoCwBQNG5 Epdf/y0no0ZSL6ykB/DPfYZmY/MZ9PtH7xOTFkjP1/8qeNfpm5DdkLmthPrhfMNz 5wXclLTvOR6QL++t861fp0S1dAxOHWAiytsAhIFVTwv+AoyLioLWYKkYY5J4NUAh 2COEKX97N0V2Skw6krzZk00XpsEBAYJWBGFgXDQpT5yuX4Sirn1bU49Vo19iJ7c1 JdJ6+4pX/IrAVsQ/ccn+ixu+7k+hGZrGgjJE6uEcOJzj6H4U6gSJV51T+7CPHJqe GfUKsuYMaO9RV+65w7c08tMPzxPyS8cMXJ++8ktbt9VMzZY41kSbgraHjmGNBk8z EJh7E3B6XCp5lLghaiEv2mWJ7Q1S5vPxHllr3LESFTaIIRMuK5bL2GS6lmit40gR Bb1WfhjzOg+R10+23+va3X2H79BP8tCb0w+kBF0M2QE2Y0ao4UEq9NnPpwqVAxnx 1qwtCRanh17XAL/r1SuAe0/mWY3w30xGqDEnelrliifbYGAS9GBFjc0MnsO71m40 2BV5TqJOHYZzb08fO0jc5RDFSbJAHHSmXa7hne2f1QggFVsJywiqWnTgXVy2sQn0 3pGtkLVrA6KigPWbmBjmJey75mBebAzyP3vF//WV9e3e7Pzz+kf4v64d8ebKI/mt ui34wc1JZ2aEPLY6Lk2Q1HRJSgM2N9yu0TCWRh69uxU=

URLs

http://7iulpt5i6whht6zo2r52f7vptxtjxs3vfcdxxazllikrtqpupn4epnqd.onion/

Signatures

Exorcist Ransomware
Ransomware-as-a-service which avoids infecting machines in CIS nations. First seen in mid-2020.
ransomware exorcist
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Modifies extensions of user files 32 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

Setup.exe

description	ioc	process
File renamed	C:\Users\Admin\Pictures\InvokeTrace.tif => C:\Users\Admin\Pictures\InvokeTrace.tif.bkgdrg	Setup.exe
File opened for modification	C:\Users\Admin\Pictures\PublishRead.raw.bkgdrg	Setup.exe
File renamed	C:\Users\Admin\Pictures\RevokeResolve.tiff => C:\Users\Admin\Pictures\RevokeResolve.tiff.bkgdrg	Setup.exe
File created	C:\Users\Admin\Pictures\SelectStep.tif.bkgdrgkey	Setup.exe
File opened for modification	C:\Users\Admin\Pictures\UseAdd.tiff	Setup.exe
File created	C:\Users\Admin\Pictures\CheckpointAssert.raw.bkgdrgkey	Setup.exe
File created	C:\Users\Admin\Pictures\PublishRead.raw.bkgdrgkey	Setup.exe
File opened for modification	C:\Users\Admin\Pictures\RevokeResolve.tiff	Setup.exe
File created	C:\Users\Admin\Pictures\UpdateEnable.crw.bkgdrgkey	Setup.exe
File renamed	C:\Users\Admin\Pictures\UseAdd.tiff => C:\Users\Admin\Pictures\UseAdd.tiff.bkgdrg	Setup.exe
File opened for modification	C:\Users\Admin\Pictures\FormatUnregister.png.bkgdrg	Setup.exe
File opened for modification	C:\Users\Admin\Pictures\LimitConfirm.png.bkgdrg	Setup.exe
File created	C:\Users\Admin\Pictures\UndoRequest.raw.bkgdrgkey	Setup.exe
File renamed	C:\Users\Admin\Pictures\UpdateEnable.crw => C:\Users\Admin\Pictures\UpdateEnable.crw.bkgdrg	Setup.exe
File opened for modification	C:\Users\Admin\Pictures\CheckpointAssert.raw.bkgdrg	Setup.exe
File created	C:\Users\Admin\Pictures\LimitConfirm.png.bkgdrgkey	Setup.exe
File opened for modification	C:\Users\Admin\Pictures\RevokeResolve.tiff.bkgdrg	Setup.exe
File renamed	C:\Users\Admin\Pictures\SelectStep.tif => C:\Users\Admin\Pictures\SelectStep.tif.bkgdrg	Setup.exe
File created	C:\Users\Admin\Pictures\UseAdd.tiff.bkgdrgkey	Setup.exe
File opened for modification	C:\Users\Admin\Pictures\SelectStep.tif.bkgdrg	Setup.exe
File opened for modification	C:\Users\Admin\Pictures\UndoRequest.raw.bkgdrg	Setup.exe
File created	C:\Users\Admin\Pictures\FormatUnregister.png.bkgdrgkey	Setup.exe
File opened for modification	C:\Users\Admin\Pictures\InvokeTrace.tif.bkgdrg	Setup.exe
File created	C:\Users\Admin\Pictures\InvokeTrace.tif.bkgdrgkey	Setup.exe
File renamed	C:\Users\Admin\Pictures\LimitConfirm.png => C:\Users\Admin\Pictures\LimitConfirm.png.bkgdrg	Setup.exe
File renamed	C:\Users\Admin\Pictures\PublishRead.raw => C:\Users\Admin\Pictures\PublishRead.raw.bkgdrg	Setup.exe
File renamed	C:\Users\Admin\Pictures\FormatUnregister.png => C:\Users\Admin\Pictures\FormatUnregister.png.bkgdrg	Setup.exe
File renamed	C:\Users\Admin\Pictures\CheckpointAssert.raw => C:\Users\Admin\Pictures\CheckpointAssert.raw.bkgdrg	Setup.exe
File created	C:\Users\Admin\Pictures\RevokeResolve.tiff.bkgdrgkey	Setup.exe
File renamed	C:\Users\Admin\Pictures\UndoRequest.raw => C:\Users\Admin\Pictures\UndoRequest.raw.bkgdrg	Setup.exe
File opened for modification	C:\Users\Admin\Pictures\UpdateEnable.crw.bkgdrg	Setup.exe
File opened for modification	C:\Users\Admin\Pictures\UseAdd.tiff.bkgdrg	Setup.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

Setup.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Setup.exe
File opened for modification	\??\Z:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Setup.exe

Enumerates connected drives 3 TTPs 25 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Setup.exe

description	ioc	process
File opened (read-only)	\??\O:	Setup.exe
File opened (read-only)	\??\M:	Setup.exe
File opened (read-only)	\??\L:	Setup.exe
File opened (read-only)	\??\G:	Setup.exe
File opened (read-only)	\??\E:	Setup.exe
File opened (read-only)	\??\Z:	Setup.exe
File opened (read-only)	\??\W:	Setup.exe
File opened (read-only)	\??\T:	Setup.exe
File opened (read-only)	\??\R:	Setup.exe
File opened (read-only)	\??\Q:	Setup.exe
File opened (read-only)	\??\N:	Setup.exe
File opened (read-only)	\??\K:	Setup.exe
File opened (read-only)	\??\V:	Setup.exe
File opened (read-only)	\??\U:	Setup.exe
File opened (read-only)	\??\S:	Setup.exe
File opened (read-only)	\??\A:	Setup.exe
File opened (read-only)	\??\X:	Setup.exe
File opened (read-only)	\??\H:	Setup.exe
File opened (read-only)	\??\F:	Setup.exe
File opened (read-only)	\??\I:	Setup.exe
File opened (read-only)	\??\D:	Setup.exe
File opened (read-only)	\??\B:	Setup.exe
File opened (read-only)	\??\Y:	Setup.exe
File opened (read-only)	\??\P:	Setup.exe
File opened (read-only)	\??\J:	Setup.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe

Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

996 vssadmin.exe

pid	process
996	vssadmin.exe

Modifies data under HKEY_USERS 484 IoCs

Processes:

Setup.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c005200650063006f0076006500720079005c00570069006e0064006f0077007300520045005c0062006f006f0074002e0073006400690000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 47445bf1cae469f42c13443a3a05af590e3d0f67e3d18a7ffa41fc5bb1fec54c	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c005300750062006d0069007400570072006900740065002e0064006f006300780000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 28801a89f0fe20562cb2bdd23a0701d30496defd12588512ac428528e881f1bc	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 16936534bf4bf111636daf8aeaba2d7bac06d527b04c5318d8332ecebf9aac93	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 1a32b839e0e4a38733d2ff35b917c43d452454bc6a1f6307b70dd5e64378983c	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 4ef806c331f988da2116fc9b6a4af5b1f7883d7663b0c0c79de37a5d08532b74	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = f3f623023bf1ddea61c09c307eb57d6f8e8f9cef2e21083ba49d5303c32cc7fa	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = fffa6126055524905b274381d9f9be11afdfa6b0097cf23be72d7a2357b15669	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c00500069006e006700500072006f0074006500630074002e0076007300740000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = ca8f8818bd97edf565669c77cafbd709f240bc11d1e280490557fb43d44ad3e5	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = a3f5adcb4124d099ff429b0223278709f81ff23bb8bef7b79d86c8a69b31a033	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = e6e757ea81dd72a27ca98647589a4bcf5ad3530d5dee82005d21022e4c2d9de3	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c00410064006400440069007300610062006c0065002e0063006c00720000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c0045007800690074004a006f0069006e002e006d006800740000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 589c3eccb907d98dd0e8e620ccef09d797b226b192a684095829681e8290e914	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = bdeea924b1e6c39c35b820091340986caf1f921141c330fc41e17bab09fd5d8b	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 7339e316ed85e2788a4b1e32342dfa15c4f993961ee6877308415f980db90f16	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = f1788c8e0ee9c8836174b90b88e730abb91e0c42c6c4ea3c4b7afaa88010d42b	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c0044006900730063006f006e006e0065006300740053006b00690070002e00330067007000320000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = ea5dbf1cf9eee288822e6bc34fbcb08623342153a331b6b3c322c6362a5993dc	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 34db8564b4b9eeb8cbe56d315e265c02dd6e761a30734ecd975f8aee777e356b	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = e8bf5df9125d7b444a0c9a9b2d6597bbdc1b2296865b0cab52264c80357c6e1c	Setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 0dd7015028ae33cc454231aeb2c847c15eb30cb5def337c638c5760a9170e65a	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 6a0cd07870cd2ae0ded4710625349745d0a54516342af3e04f40d9a575712903	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 69701a9f445a4c21216587a712f5047ed6d73cc43dcccab69ed3f598c82dbb70	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 06c773247074d48c9cb3d83fee6a22df5e4da4ed8ce671f71b3942e7e9c6f748	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = c4050212f852e3d22758fd1f225e6faecb289ccbe7812952c5d62f81b910644a	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c00570072006900740065004c0069006d00690074002e0076007300780000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c004a006f0069006e004d006f0075006e0074002e0033006700320000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 5d08657b996657bbe4a958dce475a23dd3913b29b4320a75c51b1cc0339fa70e	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c005200650073007400610072007400520065006e0061006d0065002e0033006700700000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c00500069006300740075007200650073005c005200650076006f006b0065005200650073006f006c00760065002e00740069006600660000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c00530074006f00700043006f006e0076006500720074002e0065006d00660000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = dcd77e88c8e69370b6964e83dade765ba44ceb5d060b6378549c65e9d936ac71	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c004d00650061007300750072006500570061007400630068002e0064006f0063006d0000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 3d8b4d994faa62e7a4cb1ae254d9754005363846cb3ccca8fff6da830656608d	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = ce2fbe82426f352cc1fe5b96b61b6bdcf657208e432fa7c4f0edd49b1a127141	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c004d006f007600650050006f0070002e0057005400560000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = c564488b8e04fa7a76e7eb8ad0f09c7a5ab70596c681a56b0938a9ed5eec9b13	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c0050006f007000460069006e0064002e006d007000320000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c0043006c00650061007200440065006e0079002e007000700073006d0000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004d0075007300690063005c0053007700690074006300680052006500710075006500730074002e006a007400780000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c004f00700065006e0055006e0064006f002e0076007300780000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = bb8ebd7bb79fc1cd45d873a1930eaf750d40bbdfd1f57386a6b680d427c53f19	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = d3fce78c525c352fbf70778445cfc32f6d33cf3f62af494e3045ba2ad7aadcba	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = eb576c05c8b7406b073ce0458f5f2bdbbf18db8a3ceb9e84b2830d257ec568de	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = a26cdd2acadba514be6adf872ed07d53c115d4ef9874b634204c6eb6e36c47c6	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c00530061007600650052006500730069007a0065002e0077006d00610000000000	Setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = b6cd037c169d50ccb5f3a71d67df823e49b33ef99a15ae4208d699d9c8bbdc1f	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = b9022113e21f4f9be6546485a5e0c6ef089f0f0d73de6c04b95f1408976f6bb0	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = b5e73c72e4f78e93fc98bef3640c283dad1a489ff27b1efba935cb9e0d884456	Setup.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{b0616b99-0000-0000-0000-500600000000}\MaxCapacity = "15150"	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c005200650063006f0076006500720079005c00570069006e0064006f0077007300520045005c00520065004100670065006e0074002e0078006d006c0000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c004400650073006b0074006f0070005c0055006e0069006e007300740061006c006c0045006e007400650072002e0065006d00660000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f00630075006d0065006e00740073005c00530065006c00650063007400440065006200750067002e00700070007300780000000000	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = cf124af87f1ee9b72d33928745006c052b370f0509dc7badfacab014f61b45fd	Setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFilesHash = 2429bfd6dc058434065757e76144862cd0fd662260e41bdfe6d2e99825174571	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 9b0f756c4927482efaca91d2ee5a5b0ff5292b05f7f309b30540afabde2693d2	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 5cdaaff2b9017d3d702492a939a80bd7bf4b3959e16f41655aeadb3126f8b1eb	Setup.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\RegFiles0000 = 43003a005c00550073006500720073005c00410064006d0069006e005c0044006f0077006e006c006f006100640073005c00520065007100750065007300740049006e007300740061006c006c002e0063006c00720000000000	Setup.exe

NTFS ADS 4 IoCs

Processes:

Setup.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\YmjCR1\windows.sys:dhpkxqkdun	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\eylYO8\windows.sys:qvqhfjkvnrdtqgtt	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\YmjCR1\windows.sys:dhpkxqkdun	Setup.exe
File created	C:\Users\Admin\AppData\Local\Temp\Microsoft\Windows\ur5ueO\windows.sys:qxoyhxveerelbnrwg	Setup.exe

Suspicious behavior: EnumeratesProcesses 5212 IoCs

Processes:

Setup.exe

pid	process
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe
3820	Setup.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

Setup.exevssvc.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	3820	Setup.exe
Token: SeRestorePrivilege	3820	Setup.exe
Token: SeDebugPrivilege	3820	Setup.exe
Token: SeSecurityPrivilege	3820	Setup.exe
Token: SeRestorePrivilege	3820	Setup.exe
Token: SeDebugPrivilege	3820	Setup.exe
Token: SeBackupPrivilege	844	vssvc.exe
Token: SeRestorePrivilege	844	vssvc.exe
Token: SeAuditPrivilege	844	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2500	WMIC.exe
Token: SeSecurityPrivilege	2500	WMIC.exe
Token: SeTakeOwnershipPrivilege	2500	WMIC.exe
Token: SeLoadDriverPrivilege	2500	WMIC.exe
Token: SeSystemProfilePrivilege	2500	WMIC.exe
Token: SeSystemtimePrivilege	2500	WMIC.exe
Token: SeProfSingleProcessPrivilege	2500	WMIC.exe
Token: SeIncBasePriorityPrivilege	2500	WMIC.exe
Token: SeCreatePagefilePrivilege	2500	WMIC.exe
Token: SeBackupPrivilege	2500	WMIC.exe
Token: SeRestorePrivilege	2500	WMIC.exe
Token: SeShutdownPrivilege	2500	WMIC.exe
Token: SeDebugPrivilege	2500	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2500	WMIC.exe
Token: SeRemoteShutdownPrivilege	2500	WMIC.exe
Token: SeUndockPrivilege	2500	WMIC.exe
Token: SeManageVolumePrivilege	2500	WMIC.exe
Token: 33	2500	WMIC.exe
Token: 34	2500	WMIC.exe
Token: 35	2500	WMIC.exe
Token: 36	2500	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

mshta.exe

pid process

1552 mshta.exe

pid	process
1552	mshta.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

Setup.execmd.execmd.exe

description	pid	process	target process
PID 3820 wrote to memory of 648	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 648	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 648	3820	Setup.exe	cmd.exe
PID 648 wrote to memory of 996	648	cmd.exe	vssadmin.exe
PID 648 wrote to memory of 996	648	cmd.exe	vssadmin.exe
PID 648 wrote to memory of 996	648	cmd.exe	vssadmin.exe
PID 3820 wrote to memory of 1352	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 1352	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 1352	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 1444	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 1444	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 1444	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 1648	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 1648	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 1648	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 1832	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 1832	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 1832	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 2068	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 2068	3820	Setup.exe	cmd.exe
PID 3820 wrote to memory of 2068	3820	Setup.exe	cmd.exe
PID 2068 wrote to memory of 2500	2068	cmd.exe	WMIC.exe
PID 2068 wrote to memory of 2500	2068	cmd.exe	WMIC.exe
PID 2068 wrote to memory of 2500	2068	cmd.exe	WMIC.exe

C:\Users\Admin\AppData\Local\Temp\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Setup.exe"
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Enumerates connected drives
- Modifies data under HKEY_USERS
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\SysWOW64\cmd.exe
  cmd /C vssadmin Delete Shadows /All /Quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:648
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin Delete Shadows /All /Quiet
    3⤵
    - Interacts with shadow copies
    PID:996
- C:\Windows\SysWOW64\cmd.exe
  cmd /C bcdedit /set {default} recoveryenabled No
  2⤵
  PID:1352
- C:\Windows\SysWOW64\cmd.exe
  cmd /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:1444
- C:\Windows\SysWOW64\cmd.exe
  cmd /C wbadmin DELETE SYSTEMSTATEBACKUP
  2⤵
  PID:1648
- C:\Windows\SysWOW64\cmd.exe
  cmd /C wbadmin DELETE SYSTEMSTATEBACKUP -deleteOldest
  2⤵
  PID:1832
- C:\Windows\SysWOW64\cmd.exe
  cmd /C wmic SHADOWCOPY /nointeractive
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic SHADOWCOPY /nointeractive
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2500

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
PID:844

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\DECRYPT-bkgdrg-decrypt.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\DECRYPT-bkgdrg-decrypt.hta

MD5
df98c4ea28773fe02993f9ce9b0ac450

SHA1
eccde57d23de283833bfcb1bbb1dfe2c0d3a3219

SHA256
38397a8301397347087a41a375f855b5a77e5d77de5f1e3e3676d17643e175a5

SHA512
a7746841ff06321ae217102454996de302296185aba0fe8d06ddaca8348afdbbcdec8a7df7d014521fc2f6d5e87eceae89d8a350d92412c92eb0941c87209519

Download Submit
memory/648-0-0x0000000000000000-mapping.dmp

Download
memory/996-1-0x0000000000000000-mapping.dmp

Download
memory/1352-2-0x0000000000000000-mapping.dmp

Download
memory/1444-3-0x0000000000000000-mapping.dmp

Download
memory/1648-4-0x0000000000000000-mapping.dmp

Download
memory/1832-5-0x0000000000000000-mapping.dmp

Download
memory/2068-6-0x0000000000000000-mapping.dmp

Download
memory/2500-7-0x0000000000000000-mapping.dmp

Download
memory/3820-12-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/3820-85-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/3820-11-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/3820-8-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/3820-15-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/3820-17-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/3820-16-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/3820-73-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/3820-74-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/3820-10-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/3820-86-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/3820-123-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download
memory/3820-492-0x0000000008226000-0x00000000082E7000-memory.dmp

Filesize
772KB

Download
memory/3820-508-0x0000000008291000-0x0000000008352000-memory.dmp

Filesize
772KB

Download
memory/3820-665-0x00000000080E0000-0x00000000080FA000-memory.dmp

Filesize
104KB

Download
memory/3820-668-0x00000000080E0000-0x00000000080FA000-memory.dmp

Filesize
104KB

Download
memory/3820-674-0x0000000008210000-0x00000000082D6000-memory.dmp

Filesize
792KB

Download
memory/3820-9-0x0000000004B40000-0x0000000004B41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads