4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

Analysis

max time kernel
126s
max time network
71s
platform
windows10_x64
resource
win10v20210408
submitted
13-05-2021 12:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
Size

2.6MB
MD5

cd796c648d34c5ecd50b1e05a1ba2300
SHA1

bfaf62622d255bd1f9a2cd60996f0f5c17628f71
SHA256

4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d
SHA512

8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

Processes:

204.#.exe308.#.exe780.#.exe59.#.exe38.#.exe142.#.exe

pid process

944 204.#.exe
1456 308.#.exe
2116 780.#.exe
380 59.#.exe
2500 38.#.exe
1964 142.#.exe

pid	process
944	204.#.exe
1456	308.#.exe
2116	780.#.exe
380	59.#.exe
2500	38.#.exe
1964	142.#.exe

Adds Run key to start application 2 TTPs 21 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

204.#.exe308.#.exe780.#.exe59.#.exe38.#.exe4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe142.#.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	204.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	308.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	780.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	59.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	38.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	38.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	204.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	142.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	308.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	780.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	780.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	59.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	38.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	142.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FileProtector = "C:\\10a0699fa37928d39c\\spfirewall.exe"	204.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	308.#.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RegSCRLib = "regsvr32.exe /s scrrun.dll"	142.#.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	59.#.exe

Drops file in Program Files directory 64 IoCs

Processes:

4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe780.#.exe59.#.exe204.#.exe308.#.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstatd.exe	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\	780.#.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\	59.#.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	204.#.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	204.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sk-SK\	780.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jstat.exe	308.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\kinit.exe	308.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\ext\	308.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\zh-CN\	308.#.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	204.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\win32\	308.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\jabswitch.exe$	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\	204.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\	59.#.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\bin\	308.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\	204.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\jvisualvm.exe	308.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\	204.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\config\Modules\	204.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\	204.#.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\	308.#.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\javapackager.exe	204.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\rmid.exe	308.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\	204.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\da-DK\	308.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\	308.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\	308.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\	59.#.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	204.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\	204.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\policytool.exe	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\	308.#.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\java.exe	204.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pl-PL\	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\el-GR\	308.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\	780.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\serialver.exe	204.#.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\	308.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\	59.#.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\tnameserv.exe	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	204.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	204.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Triedit\	308.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\	59.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\xjc.exe	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\	204.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\	308.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\klist.exe	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File created	C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe	204.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\	780.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\	308.#.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\	780.#.exe
File created	C:\Program Files\Java\jdk1.8.0_66\bin\jsadebugd.exe	204.#.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\kinit.exe	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\bin\javaws.exe	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\	780.#.exe
File created	C:\Program Files\Java\jdk1.8.0_66\jre\bin\pack200.exe	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\	308.#.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asa	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.html	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131630-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ASP.HostEncode	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode\ = "{0CF774D0-F077-11D1-B1BC-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\JSFILE\SCRIPTHOSTENCODE	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder\CLSID	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.html	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject\ = "FileSystem Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{420B2830-E718-11CF-893D-00A0C9054228}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{32DA2B15-CFED-11D1-B747-00C04FC2B085}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HTML.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\aspfile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode\ = "{85131631-480C-11D2-B1F9-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.html	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asp	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ScriptHostEncode\ = "{0CF774D0-F077-11D1-B1BC-00C04F86C324}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile.HostEncode\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D1-F077-11D1-B1BC-00C04F86C324}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\.html	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.FileSystemObject	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\ScriptHostEncode	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE09B103-97E0-11CF-978F-00A02463E06F}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CF774D0-F077-11D1-B1BC-00C04F86C324}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Scripting.Encoder	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{85131631-480C-11D2-B1F9-00C04F86C324}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile.HostEncode	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\HTMLFILE\SCRIPTHOSTENCODE	regsvr32.exe

NTFS ADS 7 IoCs

Processes:

308.#.exe780.#.exe59.#.exe38.#.exe142.#.exe4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe204.#.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	308.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	780.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	59.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	38.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	142.#.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\systemlog.log	204.#.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe204.#.exe308.#.exe780.#.exe59.#.exe38.#.exe142.#.exe

pid	process
640	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
944	204.#.exe
1456	308.#.exe
2116	780.#.exe
380	59.#.exe
2500	38.#.exe
1964	142.#.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe204.#.exe308.#.exe780.#.exe59.#.exe38.#.exe142.#.exe

description	pid	process	target process
PID 640 wrote to memory of 2304	640	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe	regsvr32.exe
PID 640 wrote to memory of 2304	640	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe	regsvr32.exe
PID 640 wrote to memory of 2304	640	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe	regsvr32.exe
PID 640 wrote to memory of 3580	640	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe	wscript.exe
PID 640 wrote to memory of 3580	640	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe	wscript.exe
PID 640 wrote to memory of 3580	640	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe	wscript.exe
PID 640 wrote to memory of 944	640	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe	204.#.exe
PID 640 wrote to memory of 944	640	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe	204.#.exe
PID 640 wrote to memory of 944	640	4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe	204.#.exe
PID 944 wrote to memory of 2328	944	204.#.exe	regsvr32.exe
PID 944 wrote to memory of 2328	944	204.#.exe	regsvr32.exe
PID 944 wrote to memory of 2328	944	204.#.exe	regsvr32.exe
PID 944 wrote to memory of 2288	944	204.#.exe	wscript.exe
PID 944 wrote to memory of 2288	944	204.#.exe	wscript.exe
PID 944 wrote to memory of 2288	944	204.#.exe	wscript.exe
PID 944 wrote to memory of 1456	944	204.#.exe	308.#.exe
PID 944 wrote to memory of 1456	944	204.#.exe	308.#.exe
PID 944 wrote to memory of 1456	944	204.#.exe	308.#.exe
PID 1456 wrote to memory of 3676	1456	308.#.exe	regsvr32.exe
PID 1456 wrote to memory of 3676	1456	308.#.exe	regsvr32.exe
PID 1456 wrote to memory of 3676	1456	308.#.exe	regsvr32.exe
PID 1456 wrote to memory of 3680	1456	308.#.exe	wscript.exe
PID 1456 wrote to memory of 3680	1456	308.#.exe	wscript.exe
PID 1456 wrote to memory of 3680	1456	308.#.exe	wscript.exe
PID 1456 wrote to memory of 2116	1456	308.#.exe	780.#.exe
PID 1456 wrote to memory of 2116	1456	308.#.exe	780.#.exe
PID 1456 wrote to memory of 2116	1456	308.#.exe	780.#.exe
PID 2116 wrote to memory of 2608	2116	780.#.exe	regsvr32.exe
PID 2116 wrote to memory of 2608	2116	780.#.exe	regsvr32.exe
PID 2116 wrote to memory of 2608	2116	780.#.exe	regsvr32.exe
PID 2116 wrote to memory of 3832	2116	780.#.exe	wscript.exe
PID 2116 wrote to memory of 3832	2116	780.#.exe	wscript.exe
PID 2116 wrote to memory of 3832	2116	780.#.exe	wscript.exe
PID 2116 wrote to memory of 380	2116	780.#.exe	59.#.exe
PID 2116 wrote to memory of 380	2116	780.#.exe	59.#.exe
PID 2116 wrote to memory of 380	2116	780.#.exe	59.#.exe
PID 380 wrote to memory of 2224	380	59.#.exe	regsvr32.exe
PID 380 wrote to memory of 2224	380	59.#.exe	regsvr32.exe
PID 380 wrote to memory of 2224	380	59.#.exe	regsvr32.exe
PID 380 wrote to memory of 3244	380	59.#.exe	wscript.exe
PID 380 wrote to memory of 3244	380	59.#.exe	wscript.exe
PID 380 wrote to memory of 3244	380	59.#.exe	wscript.exe
PID 380 wrote to memory of 2500	380	59.#.exe	38.#.exe
PID 380 wrote to memory of 2500	380	59.#.exe	38.#.exe
PID 380 wrote to memory of 2500	380	59.#.exe	38.#.exe
PID 2500 wrote to memory of 2892	2500	38.#.exe	regsvr32.exe
PID 2500 wrote to memory of 2892	2500	38.#.exe	regsvr32.exe
PID 2500 wrote to memory of 2892	2500	38.#.exe	regsvr32.exe
PID 2500 wrote to memory of 4056	2500	38.#.exe	wscript.exe
PID 2500 wrote to memory of 4056	2500	38.#.exe	wscript.exe
PID 2500 wrote to memory of 4056	2500	38.#.exe	wscript.exe
PID 2500 wrote to memory of 1964	2500	38.#.exe	142.#.exe
PID 2500 wrote to memory of 1964	2500	38.#.exe	142.#.exe
PID 2500 wrote to memory of 1964	2500	38.#.exe	142.#.exe
PID 1964 wrote to memory of 576	1964	142.#.exe	regsvr32.exe
PID 1964 wrote to memory of 576	1964	142.#.exe	regsvr32.exe
PID 1964 wrote to memory of 576	1964	142.#.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe
"C:\Users\Admin\AppData\Local\Temp\4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d.exe"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s scrrun.dll
2⤵
- Modifies registry class
PID:2304

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\775478.vbs"
2⤵
PID:3580

C:\Users\Admin\AppData\Local\Temp\204.#.exe
C:\Users\Admin\AppData\Local\Temp\204.#.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s scrrun.dll
3⤵
- Modifies registry class
PID:2328

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\183315.vbs"
3⤵
PID:2288

C:\Users\Admin\AppData\Local\Temp\308.#.exe
C:\Users\Admin\AppData\Local\Temp\308.#.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s scrrun.dll
4⤵
- Modifies registry class
PID:3676

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\726284.vbs"
4⤵
PID:3680

C:\Users\Admin\AppData\Local\Temp\780.#.exe
C:\Users\Admin\AppData\Local\Temp\780.#.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s scrrun.dll
5⤵
- Modifies registry class
PID:2608

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\141445.vbs"
5⤵
PID:3832

C:\Users\Admin\AppData\Local\Temp\59.#.exe
C:\Users\Admin\AppData\Local\Temp\59.#.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:380

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s scrrun.dll
6⤵
- Modifies registry class
PID:2224

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\150844.vbs"
6⤵
PID:3244

C:\Users\Admin\AppData\Local\Temp\38.#.exe
C:\Users\Admin\AppData\Local\Temp\38.#.exe
6⤵
- Executes dropped EXE
- Adds Run key to start application
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s scrrun.dll
7⤵
- Modifies registry class
PID:2892

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\10906.vbs"
7⤵
PID:4056

C:\Users\Admin\AppData\Local\Temp\142.#.exe
C:\Users\Admin\AppData\Local\Temp\142.#.exe
7⤵
- Executes dropped EXE
- Adds Run key to start application
- NTFS ADS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s scrrun.dll
8⤵
- Modifies registry class
PID:576

C:\Windows\SysWOW64\wscript.exe
wscript.exe "C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\382488.vbs"
8⤵
PID:3264

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\10a0699fa37928d39c\spfirewall.exe
MD5
cd796c648d34c5ecd50b1e05a1ba2300

SHA1
bfaf62622d255bd1f9a2cd60996f0f5c17628f71

SHA256
4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

SHA512
8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jjs.exe$
MD5
931c0ee123d721a83dd357c73c6e84e6

SHA1
6cf8b7857528f6f9f32349b6ed41ca11faeee83e

SHA256
d55f6d133c9f66fb94c232657c4a9c57f95c457dd3bec2ca0a44aa325f7b8aea

SHA512
0a34c1bd7ad5b1d63845ef30e29545aad2bdb6443da823d1da4242f1f71b92ffc6b5744f2e9824fe4091edc4e0ba2da66022b8c0183202b202299cc553b75952

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe
MD5
45efe7e2c9e462e1990a5dd8608afc96

SHA1
f2254c90a102501ee6d6317f3d4b942e222fd4ff

SHA256
a85aa9c711b4bb4122a368fd22f345e1f9724cd9e1a0402076af88573a7541ad

SHA512
a3983ee1f687cdb707a8a765b08490763857d12a04be82a50837aba2d3b9d2916989276a3b6dcde1340607cad8c8bbe4e21c479d793e59c4f4349a77dc201573

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe$
MD5
45efe7e2c9e462e1990a5dd8608afc96

SHA1
f2254c90a102501ee6d6317f3d4b942e222fd4ff

SHA256
a85aa9c711b4bb4122a368fd22f345e1f9724cd9e1a0402076af88573a7541ad

SHA512
a3983ee1f687cdb707a8a765b08490763857d12a04be82a50837aba2d3b9d2916989276a3b6dcde1340607cad8c8bbe4e21c479d793e59c4f4349a77dc201573

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\jps.exe$
MD5
45efe7e2c9e462e1990a5dd8608afc96

SHA1
f2254c90a102501ee6d6317f3d4b942e222fd4ff

SHA256
a85aa9c711b4bb4122a368fd22f345e1f9724cd9e1a0402076af88573a7541ad

SHA512
a3983ee1f687cdb707a8a765b08490763857d12a04be82a50837aba2d3b9d2916989276a3b6dcde1340607cad8c8bbe4e21c479d793e59c4f4349a77dc201573

Download Submit
C:\Program Files\Java\jdk1.8.0_66\bin\tnameserv.exe$
MD5
abec2256381198c9db4cc418de465b6f

SHA1
e8ba37b956cf916615c7cf36311d30a474835e30

SHA256
0f61abf00d9893a70e6f1be3ea7c609cf8289d7001783535ce61050b783c7342

SHA512
7271f72c480851dd97b3f4640e81e22a8ad89887a1fd846b4bf3d90d2f295165e2cf91ec21fced68a804b992f2c4f9cff0c29b70e2f4b23a67f72d42152f19f0

Download Submit
C:\Program Files\Java\jre1.8.0_66\bin\keytool.exe$
MD5
6f028ff5b76c8625fb28bd8beaf6e144

SHA1
a123feb6c079424abb84d71bf863c91f87517457

SHA256
c5de37facb2525c990673e8f608c07f6a2bc140e58ce6d47a89fdfc0bebc3a1a

SHA512
4ccdf36790586f9c48fcaf782f2be4e851dc1bd6584ec99b50eb878123bd7ec53e4613bc96a7c8f1ed964634e4ed32503657c4ddc62e3139553f783072a22d4a

Download Submit
C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
MD5
e6b3499fa5abb9a3e781c9f9a9c5d2b6

SHA1
3aa759815542bc0bd3fbf13017ec3ef35fc345e6

SHA256
c7c407e4d2be1e5b9c89583e2dc54078db34368b96c3960b9f361dac84651ac3

SHA512
4eb702ae8c04360cbe0553a853d6b5f77171e4171cfb5ec713f2255f62a28c8636c910c13ba93e51d0723fa724c9769347d62292a76eddde98a0b7917c87078f

Download Submit
C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$
MD5
83e4daf335597fb3e7256a3638767f2b

SHA1
1f89d44d865c910bd388d1f0075255c785e3efaa

SHA256
f85136fa305a374ce6514315b2bb0e7b6c6add1a6155382d70ed0a5e0c2b7410

SHA512
2a789c54db6cff13283ca84e1fedd1b747016c6c024260c3cd9aa38c24463d0f447a3f502b6046d998de620bcac7d23e4e46327fa40f5ed8df7ac7a569403de0

Download Submit
C:\Users\Admin\AppData\Local\Temp\142.#.exe
MD5
cd796c648d34c5ecd50b1e05a1ba2300

SHA1
bfaf62622d255bd1f9a2cd60996f0f5c17628f71

SHA256
4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

SHA512
8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\142.#.exe
MD5
cd796c648d34c5ecd50b1e05a1ba2300

SHA1
bfaf62622d255bd1f9a2cd60996f0f5c17628f71

SHA256
4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

SHA512
8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\204.#.exe
MD5
cd796c648d34c5ecd50b1e05a1ba2300

SHA1
bfaf62622d255bd1f9a2cd60996f0f5c17628f71

SHA256
4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

SHA512
8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\204.#.exe
MD5
cd796c648d34c5ecd50b1e05a1ba2300

SHA1
bfaf62622d255bd1f9a2cd60996f0f5c17628f71

SHA256
4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

SHA512
8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\308.#.exe
MD5
cd796c648d34c5ecd50b1e05a1ba2300

SHA1
bfaf62622d255bd1f9a2cd60996f0f5c17628f71

SHA256
4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

SHA512
8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\308.#.exe
MD5
cd796c648d34c5ecd50b1e05a1ba2300

SHA1
bfaf62622d255bd1f9a2cd60996f0f5c17628f71

SHA256
4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

SHA512
8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\38.#.exe
MD5
cd796c648d34c5ecd50b1e05a1ba2300

SHA1
bfaf62622d255bd1f9a2cd60996f0f5c17628f71

SHA256
4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

SHA512
8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\38.#.exe
MD5
cd796c648d34c5ecd50b1e05a1ba2300

SHA1
bfaf62622d255bd1f9a2cd60996f0f5c17628f71

SHA256
4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

SHA512
8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\59.#.exe
MD5
cd796c648d34c5ecd50b1e05a1ba2300

SHA1
bfaf62622d255bd1f9a2cd60996f0f5c17628f71

SHA256
4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

SHA512
8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\59.#.exe
MD5
cd796c648d34c5ecd50b1e05a1ba2300

SHA1
bfaf62622d255bd1f9a2cd60996f0f5c17628f71

SHA256
4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

SHA512
8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\780.#.exe
MD5
cd796c648d34c5ecd50b1e05a1ba2300

SHA1
bfaf62622d255bd1f9a2cd60996f0f5c17628f71

SHA256
4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

SHA512
8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\780.#.exe
MD5
cd796c648d34c5ecd50b1e05a1ba2300

SHA1
bfaf62622d255bd1f9a2cd60996f0f5c17628f71

SHA256
4253c4df27e579d4bd16a83e63978cb1b580118f895a3ed51198ad04c620913d

SHA512
8a33f3a42a3675ab0115249ecbeb5fd559faaa32f5286356e892eda6bf860bda449002c201ea46fa1e35d8b8ddb2b7bef43d8cee1ba6b5019899935ff5f957b5

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\10906.vbs
MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\141445.vbs
MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\150844.vbs
MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\183315.vbs
MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\382488.vbs
MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\726284.vbs
MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
C:\documents and settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\2C10A89\775478.vbs
MD5
e98740f59246b23b0d7f73f141f24d47

SHA1
1bfd55b3f13c85f94e1694bffa89a2d79a61a630

SHA256
68af315a2e48e340c71d9235a050dac6f82ac1c10fcc4b7158aeb32230530a9a

SHA512
d00ecfc709dc1fc912203f98118a6c47d7a01dfd13f8bf1acd3a7cc9a80ad184507788b027990af47659505e5a09e61f852f73e6529766429a2af8bf0358e928

Download Submit
memory/380-144-0x0000000000000000-mapping.dmp

Download
memory/576-171-0x0000000000000000-mapping.dmp

Download
memory/944-119-0x0000000000000000-mapping.dmp

Download
memory/1456-128-0x0000000000000000-mapping.dmp

Download
memory/1964-165-0x0000000000000000-mapping.dmp

Download
memory/2116-136-0x0000000000000000-mapping.dmp

Download
memory/2224-149-0x0000000000000000-mapping.dmp

Download
memory/2288-126-0x0000000000000000-mapping.dmp

Download
memory/2304-116-0x0000000000000000-mapping.dmp

Download
memory/2328-124-0x0000000000000000-mapping.dmp

Download
memory/2500-155-0x0000000000000000-mapping.dmp

Download
memory/2608-141-0x0000000000000000-mapping.dmp

Download
memory/2892-160-0x0000000000000000-mapping.dmp

Download
memory/3244-150-0x0000000000000000-mapping.dmp

Download
memory/3264-173-0x0000000000000000-mapping.dmp

Download
memory/3580-117-0x0000000000000000-mapping.dmp

Download
memory/3676-133-0x0000000000000000-mapping.dmp

Download
memory/3680-134-0x0000000000000000-mapping.dmp

Download
memory/3832-142-0x0000000000000000-mapping.dmp

Download
memory/4056-162-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads