neshta | dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8

Analysis

max time kernel
69s
max time network
76s
platform
windows7_x64
resource
win7v20210408
submitted
25-09-2021 05:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
Size

94KB
MD5

be56a866861c0cc91ff470f769d74d22
SHA1

87ee58769b0c3eb629434ba0c5f9d3cd65accd4d
SHA256

dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8
SHA512

5be5f4ae7eb08a5a54bfa5dc0d000b94c69843e88b7e792350b0716390228df67ec2b1bb618b701a58cfe75fbaa5dd800d6c7f40a2cb4ea1d7f0a5b8eaf97d38

Score

10^/10

neshta persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Public\Desktop\how_to_back_files.html

Ransom Note

Your personal ID ☠ Your files are encrypted! ☠ All your important data has been encrypted. To recover data you need decryptor. To get the decryptor you should: Send 1 test image or text file [email protected] or [email protected] . In the letter include your personal ID (look at the beginning of this document). We will give you the decrypted file and assign the price for decryption all files After we send you instruction how to pay for decrypt and after payment you will receive a decryptor and instructions We can decrypt one file in quality the evidence that we have the decoder. Only [email protected] and [email protected] can decrypt your files Do not trust anyone [email protected] and [email protected] Do not attempt to remove the program or run the anti-virus tools Attempts to self-decrypting files will result in the loss of your data Decoders other users are not compatible with your data, because each user's unique encryption key ��

Emails

[email protected]

Signatures

Detect Neshta Payload 28 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	family_neshta
C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\misc.exe	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE	family_neshta
C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

pid process

1880 dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

pid	process
1880	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

Modifies extensions of user files 11 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\ResolveGroup.tiff	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File renamed	C:\Users\Admin\Pictures\ResolveGroup.tiff => C:\Users\Admin\Pictures\ResolveGroup.tiff.SATANA	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File renamed	C:\Users\Admin\Pictures\SkipMount.png => C:\Users\Admin\Pictures\SkipMount.png.SATANA	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File renamed	C:\Users\Admin\Pictures\DismountReset.tif => C:\Users\Admin\Pictures\DismountReset.tif.SATANA	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File renamed	C:\Users\Admin\Pictures\HidePing.crw => C:\Users\Admin\Pictures\HidePing.crw.SATANA	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File renamed	C:\Users\Admin\Pictures\PublishRemove.crw => C:\Users\Admin\Pictures\PublishRemove.crw.SATANA	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Pictures\ResizeAdd.tiff	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File renamed	C:\Users\Admin\Pictures\ResizeAdd.tiff => C:\Users\Admin\Pictures\ResizeAdd.tiff.SATANA	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File renamed	C:\Users\Admin\Pictures\DebugCompare.tif => C:\Users\Admin\Pictures\DebugCompare.tif.SATANA	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File renamed	C:\Users\Admin\Pictures\SuspendUnlock.tif => C:\Users\Admin\Pictures\SuspendUnlock.tif.SATANA	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File renamed	C:\Users\Admin\Pictures\SyncDebug.tif => C:\Users\Admin\Pictures\SyncDebug.tif.SATANA	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

Loads dropped DLL 6 IoCs

Processes:

dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

pid	process
1652	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
1652	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
1652	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
1652	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
1652	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
1652	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\BrowserUpdateCheck = "C:\\Users\\Admin\\AppData\\Local\\dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe"	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

Drops desktop.ini file(s) 27 IoCs

Processes:

dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

description	ioc	process
File opened for modification	C:\Users\Public\Libraries\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Public\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

Drops file in Program Files directory 64 IoCs

Processes:

dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exedad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialLetter.dotx	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ACCDDSF.DLL	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BDRTKFUL.POC	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CALHM.POC	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTOC.XML	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\ResourceInternal.zip	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\ClassicPhotoAlbum.potx	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\excel.exe.manifest	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EXSEC32.DLL	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\INTLDATE.DLL	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OUTLVBS.DLL	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTIRM.XML	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SOCIALCONNECTOR.DLL	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\AppConfig.zip	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Synchronization Services\ADO.NET\v1.0\Microsoft.Synchronization.Data.Server.dll	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EXLIRMV.XML	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.BusinessData.dll	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PPTIRMV.XML	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGACCBOX.DPV	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSIDEBR.DPV	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTOC.DPV	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\FOLDPROJ.XML	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GREET11.POC	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABEL.DPV	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\PROGRA~2\Google\Update\1335~1.452\GOOGLE~2.EXE	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Documentation\1033\License Agreements\how_to_back_files.html	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADVCMP.DIC	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSEvents.man	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ContactPicker.dll	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\IEAWSDC.DLL	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MLSHEXT.DLL	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBCONV.DLL	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGWEBCAL.DPV	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\EXLIRM.XML	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGATNGET.XML	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GIFT98.POC	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\HEADINGBB.DPV	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MAIN.XML	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Students.accdt	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\JFONT.DAT	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\mspub.exe.manifest	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OIMG.DLL	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OUTLRPC.DLL	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\CONTACTINFOBB.DPV	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBORDER.DPV	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice-install.log	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Stationery\how_to_back_files.html	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.BusinessData.xml	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ONWordAddin.dll	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SCNPST64.DLL	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BIZFORM.XML	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BZCARD11.POC	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGCAL.DPV	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSIDEBRV.XML	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\System.AddIn.dll	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PSTPRX32.DLL	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\Tasks.accdt	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Payment Type.accft	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

Drops file in Windows directory 1 IoCs

Processes:

dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

description ioc process

File opened for modification C:\Windows\svchost.com dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8043a3c2dcb1d701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006bba3c57ae0cf04a89c6a8cb0086140000000000020000000000106600000001000020000000d227815531461056222d54884312b83c790c45b3121562378127b43d17c3719b000000000e800000000200002000000016ca8f4810784a545b48160c110e02c6faa3f890f7062efd1d51283c10567e2d900000004599ad36dad72a501712c421bc60e074d55988a33565018b88f4cbcddc3ee8d34b0a52e53e1810f42f6f0f0650084eb995ee10a9c90c900e5ad185e9ebc508060ef2b2bfe08a18aa1c4379eb5d1e7e8751fd0f57dbb4e919d4776156b0ad507999cec1a5c75256ba7ba986522ad7b513a421b4302a63b45a63777074120c0c09c774418623bf165a4a0ee512fcc3068f400000005b2025b64a70b38a407e0e502fe4a650db15a7abbbc5af37ad7c65ddadb47556c7ea947ea5fd1af6b9453996b9cd8e255c4d8106a9cf448428b90aa40da3ff89	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E88DF541-1DCF-11EC-BC8F-F6C7ED530D52} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006bba3c57ae0cf04a89c6a8cb0086140000000000020000000000106600000001000020000000c28e79437fcc6e666bed89acee45b2236ae1749f1d0698336e08c8eb557d77dc000000000e8000000002000020000000b72cc3b2f5343a75cc654792da31cb03e8922259f13c088353a1c219570a88542000000036e0bccdc5f235ff605e06ac6bd0b6f9df5ad2e161dec25e905692f798a07d56400000004ace408f40fa13f38c18c94e6b16fbfa2cffd2c7a6f07a23cde499978aad3b6ca3c4a74141f0499b91db557dd4a4bb14da96bd3e80f3c79e848482d996db9a7a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Modifies registry class 1 IoCs

Processes:

dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

1020 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

1020 iexplore.exe
1020 iexplore.exe
368 IEXPLORE.EXE
368 IEXPLORE.EXE
368 IEXPLORE.EXE
368 IEXPLORE.EXE

pid	process
1020	iexplore.exe

pid	process
1020	iexplore.exe
1020	iexplore.exe
368	IEXPLORE.EXE
368	IEXPLORE.EXE
368	IEXPLORE.EXE
368	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exeiexplore.exe

description	pid	process	target process
PID 1652 wrote to memory of 1880	1652	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
PID 1652 wrote to memory of 1880	1652	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
PID 1652 wrote to memory of 1880	1652	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
PID 1652 wrote to memory of 1880	1652	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe	dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
PID 1020 wrote to memory of 368	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 368	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 368	1020	iexplore.exe	IEXPLORE.EXE
PID 1020 wrote to memory of 368	1020	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
"C:\Users\Admin\AppData\Local\Temp\dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\Temp\3582-490\dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe"
2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1880

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Public\Desktop\how_to_back_files.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1020

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1020 CREDAT:275457 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:368

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE
MD5
a963eb2a72c4e45490686855dc9babc4

SHA1
d2347e2efb984332e24858e0c67533ba5e10a5c8

SHA256
19255beead0f01ee53d9d9fc6fa2ffb54c6d04ce0435f93749e26cc436e4f56c

SHA512
6ba2bf0cb7ccf6ad15795cfed07aed9ba7779c677ec98d394f6eab8193eeca3ded19946f537d3b13e7e076a807724d601003b201cb3a34700d316f6386913056

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
MD5
6223f6710a50ace015791c6ebfa30a6a

SHA1
38605d678d1708ec6713528e2e06a5578f851a8a

SHA256
ef38dc9edb817948567166017279bd06d47f4cc7a3d8e617a748d2e74afa4b8b

SHA512
b72f3280ca343efc054d6331d5495545c59a5b38a9de5bdf48d50e092107df00f246cb9976c808a4289e403b7be0d945cf1c82483c72c803b495a62279195619

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE
MD5
178d0b8742eb836e8b753dca8f7e469c

SHA1
c84760bdb006f82b3fde2efb27337e4b856398b6

SHA256
42edc5631f69ced2debbb7ba693f7c6ce5ac7aa7df35abb732844a3aa9d60818

SHA512
89d8801fc0f6a45e69bb33926ef8e951f2600c5740b6bf98c48198da789ba8c846071459e7e9a7fffcbc1b195161a1a061c5416c3dc8afbf1696375764cf35ea

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE
MD5
337d582bdc37ba4f94c74255dd9b314f

SHA1
8d665564a752045621a60942230af6c6a92ac505

SHA256
08403feac0385fbc785a33018f63bd844170044e11a953b8d6f9d0c294a7f9f0

SHA512
e3a3f0261933220fcae8d82559dd510319f75fd7cdf21f2f8f975621753b9a2a284a6466d73e4d13f13233da77c6470405c8a06861274ba19eb9f0e30a2f6256

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE
MD5
017c16be4532705a12a73b44ade2348b

SHA1
006c6576436f4f8e4fd475c88b1ac433c5f3b538

SHA256
5ad0e5263054690e9b3233bcf716933fdca75245e7dd0de1f9a0cc1e72da433d

SHA512
44ead5d148c76e38c77cb5b14597eaa2b266c3ee0f19a946d6274b29c243762344960117f9ce6d78fcec6ec9d4d0d939f97c378ce62690829b6e29175d3f3156

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE
MD5
420babda1cfe16762e1c99ff7888d468

SHA1
8f0860bcf304b2b8677ebca11adb3efe75391acd

SHA256
461535dbb26e89641556453d4b25df907775b8aa6e313071246f9b2cf27955d0

SHA512
1b6c18f48adc7433320ec771084925b8652c4f605f95df89c7f8ffca4700207c26757bdd48649044f5ac5a7abaa62cbe8e3f637e40cd8eaa770017bb17dff5ed

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe
MD5
f39390d0a896b256e1138fc1de6f4562

SHA1
c02390aed6d5b9c1fd93957992d2da10493de0ed

SHA256
a12751c6de51c6d4d4a9a283f35d6f5067c42cb492a10bc29134b6b9987a54d7

SHA512
cac4fda2bba126eca85089744795920a4268beb5e7df447f67c0fbe3516b42ce32ac38a7a615236a527df23dc0810eca6a0504b7b3c61a9b98ec9950578b1af8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE
MD5
3ac56863fa03aa67be536b663f813f2c

SHA1
8888281a2c9ad09b2d5f3c981d02ec81844a09d1

SHA256
d7095bf9f842d8bc7c16b42ca37225fee6590eba708c662d42ec500d6f6f8a91

SHA512
539185245086deb97fa559225fb748fc4293b1c5558c9dcf512747b7d68846d12129b74f693a43862a08d087172840c6ee8d931a3b9ec19c74bb5f22d39d5693

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE
MD5
5fa639b0b32175fc1fef8e7d603c55b6

SHA1
2f3f16b7267caa7f7ea41533412c37ed7565efdf

SHA256
89ba7fe0fb919e24ca6111f1c8b31bf4fb04002a71d02012e7ec2f1255fa7841

SHA512
4851389c5519ae56c6f176ce5b60a617e2e72470c67f136e9f1b157549dba5c1b7ff5718ad6acb15e14f39e9371ae1647788924a3e96674429e7f5ac796b0051

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE
MD5
efe57ae8a73c79e72082bb354aabe21c

SHA1
1bc4c71c1bbb08aa24a3499a678b28ac7fcbdfc2

SHA256
0c077b9d71e472c27be5c65e599e6d095c73ac316e7bd1d8287e1635b83d2245

SHA512
d84be916582d626583f11948795819cb456b53c5dfccd4462c5bf89081b662fbb58226a9130dca8c3f04fdad911fd61bc1e038361ca9ae4e9643a1f06c4d2525

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE
MD5
39879f4e06fd47c49354c1117e54e435

SHA1
25a9f2375971be188ffb79013db45e459cf89a56

SHA256
43e30b16409a720deb036541016951db561b6015d519c8a7e662f2b39b4d2703

SHA512
7cc9c3b595ab6786621058e73c933a058f02e827c21834ebc85f554d7664015a3edd10ba8c6f48c7a92ce82c428e42aa4ef5a7f41a04a639adc03937029a82b4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE
MD5
e64290a0f1bf44c8b10a79ea6af6b536

SHA1
9a971f8cd1e647300d160cc36a2209b9b569fa7f

SHA256
c7a6bb5cc084c70c07313dbeb6cd66594d5d272c89b3569d8cd15ffa8371d08c

SHA512
c5935aa3f806027ebd8726d7eb40aca1cc66eca38daab4276b0a389d5152913788d582c6ad649bbb21d4dcf048db0ff8322634537e59e0dfcfd9deb6c1efa60d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE
MD5
291c5b606fac4143e5ebc8ecd8af982d

SHA1
bd0184d124c8a6a4486f3fd6ffc1495a578c0004

SHA256
e50eac06316b9b53ef73409cbd630132aec114febeecc8ae4e2ff89e9ae2a7bc

SHA512
d11a1749f158cb72c07faa1e8d5d04cffd8fb7190d894d95ac9c4fe9e4215a4bd470831a1c92450864074aca646a1f74ef353d7982f64ee577dd8c8d1ee7fe12

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE
MD5
535f23b5ef50da1864c294504a6e9b63

SHA1
c2ad2e01be84aeb5f422885dfa6bffc988c2e6ce

SHA256
cb5b08c9d2da148b831cd777374ff3ed282ba8746ac5f020d40b848ee171b1ca

SHA512
2b358ed825fd7462c447e9ecc72acc202796e1e432115a8284dc4e08096a8f8c1eb1f6d696519467605e5610ef17bbce44c0beb4455b880731b7ebdd1eb7ef79

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE
MD5
9eae988ecd9c42c4d22efa13447eacee

SHA1
b582d2d61a08ad6823ffb8619eb9d9189d7541e6

SHA256
36aca3590e4a3e5a84561580593e423117e9f400d287ee9afeb58905ca56fa86

SHA512
69e65483a6133a73a332cc88f74826f5827932111466dafcaad6568e80df0f78b5c900e25813d8e24b79857202e7dc6a6ff05b050c813428ef39afbcdee2f216

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OIS.EXE
MD5
7661e283b82711f2e3f92dacd7e85811

SHA1
eb0b883134b4300d9dde5f4387e1329ff6c738b5

SHA256
131b6c8ea5b0b0e38d94155f69efb15209cb58af317b7804543915c3285aba5d

SHA512
02295591756e86f157eed7543d953dda011588fe49e5c95fe323e0212158b0fa0f249facf419b30c6fad3b289c79fc1997eb068e7ff6286eb99b372aa784ab0f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE
MD5
5056e13183e957b64ed6cea33d3e4129

SHA1
63a346c05028fb5444d7f63e771a9590a06784ab

SHA256
f1e84d08451de27f1fed1720fed6fe4408834641e56d763272ea5b0c86662df5

SHA512
68dc427af37b268b507faa8724d0aeef069905a5ffc50b9b33fde15e81ef6cb9c17c94d0937e6b30854720157713d9f679d4469fa530618a8fe14e77f961e8a8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
MD5
d3fb4317f1279494c7a2adf9eba7acec

SHA1
ddb55e176ab348f5f2f68243b9c262ccf489bc9e

SHA256
85540e547fbf6c9c3937d98daf82f138dcd0d6ab8e06f6958765a696caa63517

SHA512
b24ccd7f3dd403a95ceddd23e96b15d3590b605ae09c87170edcae0861ec03885cb5778baf5a13b6561537c2c40147a6825efeb2f1d010aeb81291e20952b057

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
MD5
3777a4191a34ca74c7ce029fcc750a6d

SHA1
f2b3da6e4a0e954fb9d223b0a30f0ae4fd900a44

SHA256
fbb3060fd4a090ddabbce192c64861fe99d207d34ce55dc69791f88737a57d51

SHA512
f252dbd9731b599ad2f4e2e5eada76955004a06726a3c5136eb4ec475e0a413179807416021a32d0b94ae4569913c878f3ff265912a6b7152578400e49aa2f0f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE
MD5
5e37032964be56cfdf08e199b7e0c523

SHA1
2797470cbfcb6a40346c3fd37810d40ddba24197

SHA256
eb45d5bd3d82f9aeeba13928620f997fa6bb2e9773de5249a7863e92909171a1

SHA512
2309f6a75da56763a316d7c483f716e10144290d3eb4227a4ed46d2a945bec471299e0b4e351f15a15ba566c806f50c894d84c16582137beded9ded49041d705

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE
MD5
224997a8cac99ad99ecc1e67476664bc

SHA1
9f2ed1ad81e2df3b50d6290f8300810f6a18ddf0

SHA256
9acf7243aad4e19ad8d66da61739aeee4362ab3b9227558f4158a5d6b2a6f824

SHA512
2b8e0f40848c1be4531db1ad0d0d5028fb21ea8a13d5144db9604a3f4582945b069386927572d01729f7edafdc39ac4ee35ed2a1043cc083f5f938ef8756a04c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE
MD5
5d2c6c11a0edc6a6f21540942921c11b

SHA1
720a6278e2422a48f0774f6a8e71f682fc9262da

SHA256
3dc0f52d17601ff30077bf3aaf95da0dd5ed8bfe55ee64fced933c15608d2516

SHA512
dfe2fcbc7e8f6b0fb86c516f66150621f70d7655b8865090cc55a0d76f84f755296686be57378c94bcfd146cf3bb1497f5098dccd5fcceda6c91887b579780fe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
MD5
0666e6a23962906a24f028ab22663488

SHA1
17f1ff9e4eede0666af42bad195eb452ed1e0b51

SHA256
0cfdcadc2c25a50dfd06bff75fd433e279edf131ed1ada27acf4c684069a2e3d

SHA512
1f65725202dac8cd4ec8ca5a2262ab02278c68e1394df5c95da6cfc511fe22d18c35547c3bb1ee7ac27f8b24ede66d6412eaea2a4e278c799caccd3911b835f3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE
MD5
159e4ff031b865817cc50519ba0f6a82

SHA1
1c0832c8fe0b45245ca2ed93135396581191b4d9

SHA256
b51e1d1a53b33c5f73aaf4b44266c0a44fd0216f23429425453bf5e7d8b4600d

SHA512
1c536c5ad40c6173ec90f78e4ffd9d9416d60e6bdb54ceb72e71faed5b76c766218eabdcee3a9d39f51e2056831260466e6aa54655dbc3a1701bed5378a0d1b4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE
MD5
37564324810dc0c001216aee84baff38

SHA1
50e58cb182338b978d493ed2c3e43027eb737104

SHA256
c2be46ccb8a3001d38edf0f9f7495bfa3aaa9ede06af1144bd1e85cdfc831489

SHA512
df6e8b627dd848bac32a1f9fb9f992d4f0c072c0408f917e273a35e81005ea3d16faf5d0668d4fa8471c4b0d6fc8c10ae1d5b72cce3cbbcba5aaf110a2da2401

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\misc.exe
MD5
24abef2b56b0793062172fed3d2856f5

SHA1
c53aec96e745d36bca7bd5aeb3cd7e9675077432

SHA256
7a45f962e10cda7651729d4005c8ab0b59381bfb5187ce2ddbe72b5e81f6867c

SHA512
4f6c7e69ecf125d2aa00c21aa7a4a410c0bf28b3a1ac632eaba282b85fd7863b355fd0d7a303554f4d146ddda329ad724692842a1e4cc16494189872664dd909

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
MD5
d70ae072299533cda7b8ecb0cbebcebc

SHA1
a3b1fd30c4f6eea286010ecd28694b344bbab4e7

SHA256
97cb429e80847a4e5f7f2fe4950edc262a37988b8f48d99239948ad7b36f89e9

SHA512
c847349e163950df5d6adcc17b4193d9b117efed9725720db109b7f9f8edaf4b5ab65e4540166cd433c9871114a6276e7cf430b9b87a1c4f0dcc739761bfd20b

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
MD5
47a69138132990f0efa57ce740a1bd9e

SHA1
de5b83bd3db6a3a516ec0c84cad08272c2c3ba79

SHA256
f5689b20d18c4ca2e3f8bf55bc372789cf097dc9570d8e8194b80298a85a0b4d

SHA512
b14ab9d1a0fd538d558e1de85037439164170a5866d8166d781b840ced74b90d23725d7b698f0f09ba7b08728c43b405c15b49aa50cd968a7b0ea01d902d25be

Download Submit
C:\Users\Admin\AppData\Local\DAD353~1.EXE
MD5
6850d4e316c45e8f7b718227fae08c04

SHA1
80650938e0feb289f38c92b158be451093b8c6ff

SHA256
8c1060b271d9bb1013d94c5fd13b59e60a96226104d002544e997257a03e0989

SHA512
1adce21b394e25999a3b870fdffce74dff66f80257956e603ee524b813497c340b968547af89f5c782ff54cc38a8a2c87e00e0865bb23b86b35246be95157294

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
MD5
6850d4e316c45e8f7b718227fae08c04

SHA1
80650938e0feb289f38c92b158be451093b8c6ff

SHA256
8c1060b271d9bb1013d94c5fd13b59e60a96226104d002544e997257a03e0989

SHA512
1adce21b394e25999a3b870fdffce74dff66f80257956e603ee524b813497c340b968547af89f5c782ff54cc38a8a2c87e00e0865bb23b86b35246be95157294

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
MD5
6850d4e316c45e8f7b718227fae08c04

SHA1
80650938e0feb289f38c92b158be451093b8c6ff

SHA256
8c1060b271d9bb1013d94c5fd13b59e60a96226104d002544e997257a03e0989

SHA512
1adce21b394e25999a3b870fdffce74dff66f80257956e603ee524b813497c340b968547af89f5c782ff54cc38a8a2c87e00e0865bb23b86b35246be95157294

Download Submit
C:\Users\Public\Desktop\how_to_back_files.html
MD5
4cf22124e6836b7d10c1264194d4b3f8

SHA1
579ca4fd83657217b6b2376244c520f2168a46d0

SHA256
4661d14e97e94bcbbae6a189e1f3101cec2aba180dc5061f9b5d5281b7070d9b

SHA512
215660657640075a56607f7f8ccde79150e4764b3cb76713dae83761d69717f8a8194b30cff2df1206bad84960b66da12d0c90feabf991caa036d83dd732c70e

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\PROGRA~2\Google\Temp\GUMFBCB.tmp\GOFB2B~1.EXE
MD5
583ff3367e050c4d62bc03516473b40a

SHA1
6aa1d26352b78310e711884829c35a69ed1bf0f9

SHA256
6b63f8dd47d8b3baa71b6cd205d428861b96bf09cf479071e75ddd23f97c0146

SHA512
e9bdd5cc2e29db48cc524488fbadb08e808f17f6e18fa595cfebae229c94f2547079e52a2ada214169577b89b2ffbef424729cd90acdea3774f5c76aec192be0

Download Submit
\PROGRA~2\Google\Update\1335~1.452\GOFB2B~1.EXE
MD5
583ff3367e050c4d62bc03516473b40a

SHA1
6aa1d26352b78310e711884829c35a69ed1bf0f9

SHA256
6b63f8dd47d8b3baa71b6cd205d428861b96bf09cf479071e75ddd23f97c0146

SHA512
e9bdd5cc2e29db48cc524488fbadb08e808f17f6e18fa595cfebae229c94f2547079e52a2ada214169577b89b2ffbef424729cd90acdea3774f5c76aec192be0

Download Submit
\Users\Admin\AppData\Local\DAD353~1.EXE
MD5
6850d4e316c45e8f7b718227fae08c04

SHA1
80650938e0feb289f38c92b158be451093b8c6ff

SHA256
8c1060b271d9bb1013d94c5fd13b59e60a96226104d002544e997257a03e0989

SHA512
1adce21b394e25999a3b870fdffce74dff66f80257956e603ee524b813497c340b968547af89f5c782ff54cc38a8a2c87e00e0865bb23b86b35246be95157294

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
MD5
6850d4e316c45e8f7b718227fae08c04

SHA1
80650938e0feb289f38c92b158be451093b8c6ff

SHA256
8c1060b271d9bb1013d94c5fd13b59e60a96226104d002544e997257a03e0989

SHA512
1adce21b394e25999a3b870fdffce74dff66f80257956e603ee524b813497c340b968547af89f5c782ff54cc38a8a2c87e00e0865bb23b86b35246be95157294

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\dad35352c33a0357188ac5d9c32934fe0b8dd5c1ee639e5bc9100f85dd9b85a8.exe
MD5
6850d4e316c45e8f7b718227fae08c04

SHA1
80650938e0feb289f38c92b158be451093b8c6ff

SHA256
8c1060b271d9bb1013d94c5fd13b59e60a96226104d002544e997257a03e0989

SHA512
1adce21b394e25999a3b870fdffce74dff66f80257956e603ee524b813497c340b968547af89f5c782ff54cc38a8a2c87e00e0865bb23b86b35246be95157294

Download Submit
memory/368-72-0x0000000000000000-mapping.dmp

Download
memory/368-74-0x00000000002F0000-0x00000000002F2000-memory.dmp

Filesize
8KB

Download
memory/1652-60-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download
memory/1880-63-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads