azorult | a2d3d6430f6775951cf988d960cfae4093d7a1e4d0f684ddfffaf4599ace9a71

Resubmissions

18-11-2020 14:18

201118-dj27sn3f52 10

18-11-2020 13:42

201118-1arz86e7w6 10

18-11-2020 13:38

201118-n8jh228ctn 10

Analysis

max time kernel
1802s
max time network
1816s
platform
windows10_x64
resource
win10v20201028
submitted
18-11-2020 14:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DiskInternals_Uneraser_v5_keygen.bin.exe

Score

10^/10

azorult pony discovery evasion infostealer persistence rat spyware stealer trojan upx

Malware Config

Extracted

Family

azorult

http://kvaka.li/1210776429.php

Signatures

Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
trojan infostealer azorult
Pony,Fareit
Pony is a Remote Access Trojan application that steals information.
rat spyware stealer pony
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Blocklisted process makes network request 1 IoCs

Processes:

CScript.exe

flow pid process

44 1096 CScript.exe
Downloads MZ/PE file

flow	pid	process
44	1096	CScript.exe

Executes dropped EXE 19 IoCs

Processes:

intro.exekeygen-pr.exekeygen-step-1.exekeygen-step-3.exekeygen-step-4.exekey.exekey.exesetup.upx.exeSetup.exe4.exepub4.exefile.exe002.exeFree.exeFree.tmpsearzar.exehjjgaa.exejfiag_gg.exejfiag_gg.exe

pid	process
3004	intro.exe
3024	keygen-pr.exe
1400	keygen-step-1.exe
1796	keygen-step-3.exe
3696	keygen-step-4.exe
472	key.exe
1860	key.exe
212	setup.upx.exe
1480	Setup.exe
3220	4.exe
2112	pub4.exe
1156	file.exe
4300	002.exe
4392	Free.exe
4420	Free.tmp
4468	searzar.exe
4580	hjjgaa.exe
4664	jfiag_gg.exe
4772	jfiag_gg.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX1\setup.upx.exe	upx
C:\Users\Admin\AppData\Local\Temp\RarSFX1\setup.upx.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe	upx
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe	upx

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4.exepub4.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	pub4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	pub4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation cmd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation	cmd.exe

Identifies Wine through registry keys 2 TTPs 2 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

pub4.exe4.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Wine	pub4.exe
Key opened	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Wine	4.exe

Loads dropped DLL 2 IoCs

Processes:

Setup.exe

pid process

1480 Setup.exe
1480 Setup.exe
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

pid	process
1480	Setup.exe
1480	Setup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

hjjgaa.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kissq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kissq.exe"	hjjgaa.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

71 ip-api.com
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

4.exepub4.exe

pid process

3220 4.exe
2112 pub4.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

key.exe

description pid process target process

PID 472 set thread context of 1860 472 key.exe key.exe

flow	ioc
71	ip-api.com

pid	process
3220	4.exe
2112	pub4.exe

description	pid	process	target process
PID 472 set thread context of 1860	472	key.exe	key.exe

Drops file in Program Files directory 3 IoCs

Processes:

Setup.exe

description	ioc	process
File created	C:\Program Files (x86)\NextGen\lanret\4.exe	Setup.exe
File created	C:\Program Files (x86)\NextGen\lanret\pub4.exe	Setup.exe
File created	C:\Program Files (x86)\NextGen\lanret\pub4.vbs	Setup.exe

Drops file in Windows directory 1 IoCs

Processes:

MicrosoftEdge.exe

description ioc process

File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

4.exepub4.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	pub4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	pub4.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4624 taskkill.exe

pid	process
4624	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\NextUpdateDate = "312565810"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\5FF1348C80820F2A9	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = 5074788af7bdd601	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\5FF1348C80820F2A9 = 0300000001000000140000005ff1348c80820f2a988d0c0c7abea0ea394b5e6c040000000100000010000000fd42404f68fae3f0d490e8d19d08ab1d0f00000001000000200000005546bb2210de2560292e6f4610af4ffbdb453f9bf9983e62942c35959e16038d140000000100000014000000b3b30880146b0eb235e8e136e7d15c9c4847f5f3190000000100000010000000e142e209d34bfb2eac257eb76a2b61e15c0000000100000004000000000800001800000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d702000000001000000e5050000308205e1308203c9a0030201020213330000016fd585f24b93e88a0700000000016f300d06092a864886f70d01010b0500307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420536563757265205365727665722043412032303131301e170d3139313231323030303333315a170d3231303331323030303333315a3081a3310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b130442696e67311b301906035504031312494520496e737472756d656e746174696f6e3121301f06092a864886f70d010901161271666265406d6963726f736f66742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100cfb24782c35c66c63688c01ed857df9a4330b81628c86831de4d577f8cb2155b880ee41953a18ac28de644bacfa97558ec6f522490f103b7fa0092430f8e0ba55c36dd91f6f1f91baec6eb3581d89133141e1580e02ec2445e5380b178f92f81e97193be8be1223d36e5f2be070a3db6ac17987ea3b42d15994c73a10e64794da4660a5d875e179c567bb06ecfd7cbf4c1ee4fe453284e72877d746a3e178788a1bd540ba9250a931a11105bb98f1b2b757fa6c5ade16e7cc1d1628fedb716018526f5b56630b54cd5f75f938e9b4a956609cc441aac84a10a101f6429b6fceb9434a41b24f0ca9781bf72b010f14bd13dc5d996b6ed6c4d53156969dd04f7390203010001a38201303082012c300e0603551d0f0101ff0404030204f030150603551d25040e300c060a2b0601040182374c0c01301d0603551d0e04160414b3b30880146b0eb235e8e136e7d15c9c4847f5f3301f0603551d230418301680143656896549cb5b9b2f3cac4216504d91b933d79130530603551d1f044c304a3048a046a0448642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d69635365635365724341323031315f323031312d31302d31382e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d69635365635365724341323031315f323031312d31302d31382e637274300c0603551d130101ff04023000300d06092a864886f70d01010b0500038202010064d81278e224099c122690412271d5f2d92ae1c00f7135d64f63663ccc0588826bf24cc6cffa0d6666b7e3f989825dd1021fd1bdc6a9d4a492c0f46198534382204d8668b0f3c8d85f9f614f7fff47e391a4fdc89dba1b423f1d2a8d4986ff42bac032a21224b246b03ffef26e7da49d3ef381ff9d669cda0234445bff395be1b70627f013ccde692280d75d690b4f4c5e3a123b379bd30bdc6cf1af0c69d97eb0aa4f580eb4e876465b2c62514a612a3971f6bc6ace33f569e0cbcbd5498caf2af949952c310221a382d0a7fbc4594b0bfe96a1c81d26639b249beea28179ead8377bf70e9a09596997af2b405c5425a1e5e6e46b065016901b7cd120e2389d47924b1f834955135461f7592c9487e3910bf0de382ad5906dd8c46b321b176698caaec19d1ee10aa6679981d8f2f5c40d69240a7075ce4341305d2bbd082e03c81c41baeb557b41904482ae88d0566f339ab517ae2f84223d567f9ec734c1c5a2be39aa24c49930b6428bbe2fa300f2369e1c8cc554c14010f1ee518afa32e4bf0a15cb251d37791338f5ade8ced4b67ca5fc56320c2c2973f9b13e250dabe4a373580becf787afd552c6b293dfc7bfb1f67739c64df74ae3d373e2db9c27090fe15e58591824e4f150602af628917a6d1353919cd0a8489596f97070833a98b34c2d3a0ebafda2f81096533b773c5914d7f05e66cb17af2bcd11ad517440b5	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 40d9553ac5bdd601	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000006fe0038b03caf9588ec4a81b3983429ae603147c4a43d6a7504810f63612e248fd6af091bd3be1b60c947d63a2259ebdd63d35ad9bbfe4dcf5fcd8bee6feeb9624ca0af8392bd694e2b5bd5704e1b73dc508c16daf98e2237b4	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3d2b703ac5bdd601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 998267c856add601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f326fd3fc5bdd601	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = f0e94418c8d2d601	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

file.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	file.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	file.exe

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXE

pid process

1112 PING.EXE
3208 PING.EXE
4340 PING.EXE

pid	process
1112	PING.EXE
3208	PING.EXE
4340	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

key.exepub4.exe4.exefile.exeFree.tmpjfiag_gg.exe

pid	process
472	key.exe
472	key.exe
2112	pub4.exe
2112	pub4.exe
3220	4.exe
3220	4.exe
1156	file.exe
1156	file.exe
1156	file.exe
1156	file.exe
4420	Free.tmp
4420	Free.tmp
4772	jfiag_gg.exe
4772	jfiag_gg.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

1280 MicrosoftEdgeCP.exe

pid	process
1280	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

MicrosoftEdge.exekey.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exefile.exesearzar.exe

description	pid	process
Token: SeDebugPrivilege	1468	MicrosoftEdge.exe
Token: SeDebugPrivilege	1468	MicrosoftEdge.exe
Token: SeDebugPrivilege	1468	MicrosoftEdge.exe
Token: SeDebugPrivilege	1468	MicrosoftEdge.exe
Token: SeImpersonatePrivilege	472	key.exe
Token: SeTcbPrivilege	472	key.exe
Token: SeChangeNotifyPrivilege	472	key.exe
Token: SeCreateTokenPrivilege	472	key.exe
Token: SeBackupPrivilege	472	key.exe
Token: SeRestorePrivilege	472	key.exe
Token: SeIncreaseQuotaPrivilege	472	key.exe
Token: SeAssignPrimaryTokenPrivilege	472	key.exe
Token: SeImpersonatePrivilege	472	key.exe
Token: SeTcbPrivilege	472	key.exe
Token: SeChangeNotifyPrivilege	472	key.exe
Token: SeCreateTokenPrivilege	472	key.exe
Token: SeBackupPrivilege	472	key.exe
Token: SeRestorePrivilege	472	key.exe
Token: SeIncreaseQuotaPrivilege	472	key.exe
Token: SeAssignPrimaryTokenPrivilege	472	key.exe
Token: SeImpersonatePrivilege	472	key.exe
Token: SeTcbPrivilege	472	key.exe
Token: SeChangeNotifyPrivilege	472	key.exe
Token: SeCreateTokenPrivilege	472	key.exe
Token: SeBackupPrivilege	472	key.exe
Token: SeRestorePrivilege	472	key.exe
Token: SeIncreaseQuotaPrivilege	472	key.exe
Token: SeAssignPrimaryTokenPrivilege	472	key.exe
Token: SeImpersonatePrivilege	472	key.exe
Token: SeTcbPrivilege	472	key.exe
Token: SeChangeNotifyPrivilege	472	key.exe
Token: SeCreateTokenPrivilege	472	key.exe
Token: SeBackupPrivilege	472	key.exe
Token: SeRestorePrivilege	472	key.exe
Token: SeIncreaseQuotaPrivilege	472	key.exe
Token: SeAssignPrimaryTokenPrivilege	472	key.exe
Token: SeImpersonatePrivilege	472	key.exe
Token: SeTcbPrivilege	472	key.exe
Token: SeChangeNotifyPrivilege	472	key.exe
Token: SeCreateTokenPrivilege	472	key.exe
Token: SeBackupPrivilege	472	key.exe
Token: SeRestorePrivilege	472	key.exe
Token: SeIncreaseQuotaPrivilege	472	key.exe
Token: SeAssignPrimaryTokenPrivilege	472	key.exe
Token: SeDebugPrivilege	924	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	924	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	924	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	924	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4108	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4108	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1156	file.exe
Token: SeCreateTokenPrivilege	4468	searzar.exe
Token: SeAssignPrimaryTokenPrivilege	4468	searzar.exe
Token: SeLockMemoryPrivilege	4468	searzar.exe
Token: SeIncreaseQuotaPrivilege	4468	searzar.exe
Token: SeMachineAccountPrivilege	4468	searzar.exe
Token: SeTcbPrivilege	4468	searzar.exe
Token: SeSecurityPrivilege	4468	searzar.exe
Token: SeTakeOwnershipPrivilege	4468	searzar.exe
Token: SeLoadDriverPrivilege	4468	searzar.exe
Token: SeSystemProfilePrivilege	4468	searzar.exe
Token: SeSystemtimePrivilege	4468	searzar.exe
Token: SeProfSingleProcessPrivilege	4468	searzar.exe
Token: SeIncBasePriorityPrivilege	4468	searzar.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

4.exeFree.tmp

pid process

3220 4.exe
3220 4.exe
4420 Free.tmp
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe002.exe

pid process

1468 MicrosoftEdge.exe
1280 MicrosoftEdgeCP.exe
1280 MicrosoftEdgeCP.exe
4300 002.exe
4300 002.exe

pid	process
3220	4.exe
3220	4.exe
4420	Free.tmp

pid	process
1468	MicrosoftEdge.exe
1280	MicrosoftEdgeCP.exe
1280	MicrosoftEdgeCP.exe
4300	002.exe
4300	002.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

DiskInternals_Uneraser_v5_keygen.bin.execmd.exekeygen-step-4.exekeygen-step-3.exekeygen-pr.execmd.exekey.exesetup.upx.execmd.exeSetup.exe

description	pid	process	target process
PID 744 wrote to memory of 2248	744	DiskInternals_Uneraser_v5_keygen.bin.exe	cmd.exe
PID 744 wrote to memory of 2248	744	DiskInternals_Uneraser_v5_keygen.bin.exe	cmd.exe
PID 744 wrote to memory of 2248	744	DiskInternals_Uneraser_v5_keygen.bin.exe	cmd.exe
PID 2248 wrote to memory of 3004	2248	cmd.exe	intro.exe
PID 2248 wrote to memory of 3004	2248	cmd.exe	intro.exe
PID 2248 wrote to memory of 3004	2248	cmd.exe	intro.exe
PID 2248 wrote to memory of 3024	2248	cmd.exe	keygen-pr.exe
PID 2248 wrote to memory of 3024	2248	cmd.exe	keygen-pr.exe
PID 2248 wrote to memory of 3024	2248	cmd.exe	keygen-pr.exe
PID 2248 wrote to memory of 1400	2248	cmd.exe	keygen-step-1.exe
PID 2248 wrote to memory of 1400	2248	cmd.exe	keygen-step-1.exe
PID 2248 wrote to memory of 1400	2248	cmd.exe	keygen-step-1.exe
PID 2248 wrote to memory of 1796	2248	cmd.exe	keygen-step-3.exe
PID 2248 wrote to memory of 1796	2248	cmd.exe	keygen-step-3.exe
PID 2248 wrote to memory of 1796	2248	cmd.exe	keygen-step-3.exe
PID 2248 wrote to memory of 3696	2248	cmd.exe	keygen-step-4.exe
PID 2248 wrote to memory of 3696	2248	cmd.exe	keygen-step-4.exe
PID 2248 wrote to memory of 3696	2248	cmd.exe	keygen-step-4.exe
PID 3696 wrote to memory of 1792	3696	keygen-step-4.exe	cmd.exe
PID 3696 wrote to memory of 1792	3696	keygen-step-4.exe	cmd.exe
PID 3696 wrote to memory of 1792	3696	keygen-step-4.exe	cmd.exe
PID 1796 wrote to memory of 2388	1796	keygen-step-3.exe	cmd.exe
PID 1796 wrote to memory of 2388	1796	keygen-step-3.exe	cmd.exe
PID 1796 wrote to memory of 2388	1796	keygen-step-3.exe	cmd.exe
PID 3024 wrote to memory of 472	3024	keygen-pr.exe	key.exe
PID 3024 wrote to memory of 472	3024	keygen-pr.exe	key.exe
PID 3024 wrote to memory of 472	3024	keygen-pr.exe	key.exe
PID 2388 wrote to memory of 1112	2388	cmd.exe	PING.EXE
PID 2388 wrote to memory of 1112	2388	cmd.exe	PING.EXE
PID 2388 wrote to memory of 1112	2388	cmd.exe	PING.EXE
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 472 wrote to memory of 1860	472	key.exe	key.exe
PID 3696 wrote to memory of 212	3696	keygen-step-4.exe	setup.upx.exe
PID 3696 wrote to memory of 212	3696	keygen-step-4.exe	setup.upx.exe
PID 3696 wrote to memory of 212	3696	keygen-step-4.exe	setup.upx.exe
PID 212 wrote to memory of 204	212	setup.upx.exe	cmd.exe
PID 212 wrote to memory of 204	212	setup.upx.exe	cmd.exe
PID 212 wrote to memory of 204	212	setup.upx.exe	cmd.exe
PID 204 wrote to memory of 3208	204	cmd.exe	PING.EXE
PID 204 wrote to memory of 3208	204	cmd.exe	PING.EXE
PID 204 wrote to memory of 3208	204	cmd.exe	PING.EXE
PID 3696 wrote to memory of 1480	3696	keygen-step-4.exe	Setup.exe
PID 3696 wrote to memory of 1480	3696	keygen-step-4.exe	Setup.exe
PID 3696 wrote to memory of 1480	3696	keygen-step-4.exe	Setup.exe
PID 1480 wrote to memory of 1096	1480	Setup.exe	CScript.exe
PID 1480 wrote to memory of 1096	1480	Setup.exe	CScript.exe
PID 1480 wrote to memory of 1096	1480	Setup.exe	CScript.exe
PID 1480 wrote to memory of 3220	1480	Setup.exe	4.exe
PID 1480 wrote to memory of 3220	1480	Setup.exe	4.exe
PID 1480 wrote to memory of 3220	1480	Setup.exe	4.exe
PID 1480 wrote to memory of 2112	1480	Setup.exe	pub4.exe

C:\Users\Admin\AppData\Local\Temp\DiskInternals_Uneraser_v5_keygen.bin.exe
"C:\Users\Admin\AppData\Local\Temp\DiskInternals_Uneraser_v5_keygen.bin.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:744

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:2248

C:\Users\Admin\AppData\Local\Temp\RarSFX0\intro.exe
intro.exe 1EQy87
3⤵
- Executes dropped EXE
PID:3004

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
keygen-pr.exe -p83fsase3Ge
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024

C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:472

C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe -txt -scanlocal -file:potato.dat
5⤵
- Executes dropped EXE
PID:1860

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
keygen-step-1.exe
3⤵
- Executes dropped EXE
PID:1400

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
keygen-step-3.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:2388

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
5⤵
- Runs ping.exe
PID:1112

C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
keygen-step-4.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX1\DreamTrips.bat" "
4⤵
- Checks computer location settings
PID:1792

C:\Users\Admin\AppData\Local\Temp\RarSFX1\setup.upx.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\setup.upx.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX1\setup.upx.exe"
5⤵
- Suspicious use of WriteProcessMemory
PID:204

C:\Windows\SysWOW64\PING.EXE
ping 1.1.1.1 -n 1 -w 3000
6⤵
- Runs ping.exe
PID:3208

C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1480

C:\Windows\SysWOW64\CScript.exe
"C:\Windows\system32\CScript.exe" "C:\Program Files (x86)\NextGen\lanret\pub4.vbs" //e:vbscript //B //NOLOGO
5⤵
- Blocklisted process makes network request
PID:1096

C:\Program Files (x86)\NextGen\lanret\4.exe
"C:\Program Files (x86)\NextGen\lanret\4.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:3220

C:\Program Files (x86)\NextGen\lanret\pub4.exe
"C:\Program Files (x86)\NextGen\lanret\pub4.exe"
5⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2112

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\lgydvnqumo.exe"
6⤵
PID:4812

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\vypurmxov.exe"
6⤵
PID:4896

C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
4⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1156

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe"
5⤵
PID:4268

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1
6⤵
- Runs ping.exe
PID:4340

C:\Users\Admin\AppData\Local\Temp\RarSFX1\002.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\002.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4300

C:\Users\Admin\AppData\Local\Temp\RarSFX1\Free.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\Free.exe"
4⤵
- Executes dropped EXE
PID:4392

C:\Users\Admin\AppData\Local\Temp\is-D3EM3.tmp\Free.tmp
"C:\Users\Admin\AppData\Local\Temp\is-D3EM3.tmp\Free.tmp" /SL5="$202AE,680561,121344,C:\Users\Admin\AppData\Local\Temp\RarSFX1\Free.exe"
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4420

C:\Users\Admin\AppData\Local\Temp\RarSFX1\searzar\searzar.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\searzar\searzar.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
7⤵
PID:4536

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
8⤵
- Kills process with taskkill
PID:4624

C:\Users\Admin\AppData\Local\Temp\RarSFX1\hjjgaa.exe
"C:\Users\Admin\AppData\Local\Temp\RarSFX1\hjjgaa.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4580

C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt
5⤵
- Executes dropped EXE
PID:4664

C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt
5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4772

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1468

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2792

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:1280

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4108

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4956

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5048

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\NextGen\lanret\4.exe

Download Submit
C:\Program Files (x86)\NextGen\lanret\4.exe

Download Submit
C:\Program Files (x86)\NextGen\lanret\pub4.exe

Download Submit
C:\Program Files (x86)\NextGen\lanret\pub4.exe

Download Submit
C:\Program Files (x86)\NextGen\lanret\pub4.vbs

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1FC0448E6D3D5712272FAF5B90A70C5E

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1FC0448E6D3D5712272FAF5B90A70C5E

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E49827401028F7A0F97B5576C77A26CB_7CE95D8DCA26FE957E7BD7D76F353B08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\53UGR01M.cookie

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\7SRUIUK1.cookie

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\intro.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\intro.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
MD5
c615d0bfa727f494fee9ecb3f0acf563

SHA1
6c3509ae64abc299a7afa13552c4fe430071f087

SHA256
95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

SHA512
d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\002.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\002.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\DreamTrips.bat

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Free.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Free.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\Setup.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\file.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\hjjgaa.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\hjjgaa.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\searzar\searzar.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\searzar\searzar.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\setup.upx.exe
MD5
010ebf726b3cc67e92eb91d7afbfbd59

SHA1
02db1d5bf39903099612ddb12d4b8918657f0ec0

SHA256
a7e98ba4e9b3149d35cbf64b09bc727b5136ec8375a366ca42d66d1c4fc9e25c

SHA512
84c00731b0724a09d82410c5b0fe40d910c62076ae9fa10a385d084d4dffad5b194b38fd92d48b5fa1991b2fd6e8a370d5f4c43e7f09b424c65c41356ff48f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\setup.upx.exe
MD5
010ebf726b3cc67e92eb91d7afbfbd59

SHA1
02db1d5bf39903099612ddb12d4b8918657f0ec0

SHA256
a7e98ba4e9b3149d35cbf64b09bc727b5136ec8375a366ca42d66d1c4fc9e25c

SHA512
84c00731b0724a09d82410c5b0fe40d910c62076ae9fa10a385d084d4dffad5b194b38fd92d48b5fa1991b2fd6e8a370d5f4c43e7f09b424c65c41356ff48f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\JOzWR.dat

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\key.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX2\potato.dat

Download Submit
C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt

Download Submit
C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D3EM3.tmp\Free.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D3EM3.tmp\Free.tmp

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
MD5
7fee8223d6e4f82d6cd115a28f0b6d58

SHA1
1b89c25f25253df23426bd9ff6c9208f1202f58b

SHA256
a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

SHA512
3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
MD5
a6279ec92ff948760ce53bba817d6a77

SHA1
5345505e12f9e4c6d569a226d50e71b5a572dce2

SHA256
8b581869bf8944a8e0aa169adea2a4afe47434123da477132880aff6a5032181

SHA512
213cb374f1273c899e0c88a20c0101a7c28024ce5046a2e0d7898bd182d918288bb80367fea4454c437c057ff9ed4fffd42be48a13ca73653021a6d63e1cfa9c

Download Submit
\Users\Admin\AppData\Local\Temp\nshED08.tmp\UAC.dll

Download Submit
\Users\Admin\AppData\Local\Temp\nshED08.tmp\nsExec.dll

Download Submit
memory/204-38-0x0000000000000000-mapping.dmp

Download
memory/212-35-0x0000000000000000-mapping.dmp

Download
memory/472-24-0x0000000000000000-mapping.dmp

Download
memory/1096-46-0x0000000000000000-mapping.dmp

Download
memory/1112-27-0x0000000000000000-mapping.dmp

Download
memory/1156-60-0x0000000000000000-mapping.dmp

Download
memory/1400-11-0x0000000000000000-mapping.dmp

Download
memory/1400-10-0x0000000000000000-mapping.dmp

Download
memory/1480-43-0x0000000073020000-0x00000000730B3000-memory.dmp

Filesize
588KB

Download
memory/1480-40-0x0000000000000000-mapping.dmp

Download
memory/1792-22-0x0000000000000000-mapping.dmp

Download
memory/1796-14-0x0000000000000000-mapping.dmp

Download
memory/1796-15-0x0000000000000000-mapping.dmp

Download
memory/1860-31-0x000000000066C0BC-mapping.dmp

Download
memory/1860-33-0x0000000000400000-0x0000000000983000-memory.dmp

Filesize
5.5MB

Download
memory/1860-30-0x0000000000400000-0x0000000000983000-memory.dmp

Filesize
5.5MB

Download
memory/2112-59-0x0000000073020000-0x00000000730B3000-memory.dmp

Filesize
588KB

Download
memory/2112-65-0x00000000058C0000-0x00000000058C1000-memory.dmp

Filesize
4KB

Download
memory/2112-56-0x0000000000000000-mapping.dmp

Download
memory/2112-63-0x00000000050C0000-0x00000000050C1000-memory.dmp

Filesize
4KB

Download
memory/2248-0-0x0000000000000000-mapping.dmp

Download
memory/2388-23-0x0000000000000000-mapping.dmp

Download
memory/3004-2-0x0000000000000000-mapping.dmp

Download
memory/3004-3-0x0000000000000000-mapping.dmp

Download
memory/3024-6-0x0000000000000000-mapping.dmp

Download
memory/3024-7-0x0000000000000000-mapping.dmp

Download
memory/3208-39-0x0000000000000000-mapping.dmp

Download
memory/3220-64-0x00000000051D0000-0x00000000051D1000-memory.dmp

Filesize
4KB

Download
memory/3220-66-0x00000000059D0000-0x00000000059D1000-memory.dmp

Filesize
4KB

Download
memory/3220-52-0x0000000000000000-mapping.dmp

Download
memory/3220-55-0x0000000073020000-0x00000000730B3000-memory.dmp

Filesize
588KB

Download
memory/3696-18-0x0000000000000000-mapping.dmp

Download
memory/3696-19-0x0000000000000000-mapping.dmp

Download
memory/4268-73-0x0000000000000000-mapping.dmp

Download
memory/4300-74-0x0000000000000000-mapping.dmp

Download
memory/4340-77-0x0000000000000000-mapping.dmp

Download
memory/4392-78-0x0000000000000000-mapping.dmp

Download
memory/4420-81-0x0000000000000000-mapping.dmp

Download
memory/4468-84-0x0000000000000000-mapping.dmp

Download
memory/4536-87-0x0000000000000000-mapping.dmp

Download
memory/4580-88-0x0000000000000000-mapping.dmp

Download
memory/4624-91-0x0000000000000000-mapping.dmp

Download
memory/4664-92-0x0000000000000000-mapping.dmp

Download
memory/4772-96-0x0000000000000000-mapping.dmp

Download
memory/4812-100-0x0000000000000000-mapping.dmp

Download
memory/4896-101-0x0000000000000000-mapping.dmp

Download