neshta | e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37

Analysis

max time kernel
141s
max time network
130s
platform
windows7_x64
resource
win7-en-20211208
submitted
24-01-2022 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
Size

198KB
MD5

858c29efee084e86616b21fdc4d2a3de
SHA1

d642f7ecda3fa135761d68eb20f44d66eba798fa
SHA256

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37
SHA512

673ffc06a6c2b66808c4b174d9b90d440b320b63c4076731bf6f96fbf33ef56e8930b4ce0ec4b0e9f710f1db952cb6b1bb178a1540d6d76950dd9c646e22e1e1

Score

10^/10

neshta sodinokibi 19 29 persistence ransomware spyware stealer

Malware Config

Extracted

Family

sodinokibi

Botnet

Campaign

schluesseldienste-hannover.de

alpesiberie.com

bratek-immobilien.de

bcmets.info

log-barn.co.uk

diverfiestas.com.es

nexstagefinancial.com

mundo-pieces-auto.fr

marmarabasin.com

walterman.es

juergenblaetz.de

centuryvisionglobal.com

witraz.pl

aslog.fr

qandmmusiccenter.com

awag-blog.de

domilivefurniture.com

penumbuhrambutkeiskei.com

from02pro.com

teamsegeln.ch

Attributes

net
true
pid
19
prc
mysql.exe
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
29

Signatures

Detect Neshta Payload 24 IoCs

Processes:

resource	yara_rule
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta
C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE	family_neshta
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe	family_neshta
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe	family_neshta
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe	family_neshta
C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	family_neshta
\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	family_neshta
C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	family_neshta
\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE	family_neshta
C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	family_neshta
\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE	family_neshta
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	family_neshta
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	family_neshta
C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	family_neshta
C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{F4220~1\VC_RED~1.EXE	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Sodinokibi/Revil sample 5 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	family_sodinokobi
\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	family_sodinokobi
C:\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	family_sodinokobi
C:\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	family_sodinokobi
\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	family_sodinokobi

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exesvchost.com

pid process

1764 e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
568 svchost.com

pid	process
1764	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
568	svchost.com

Loads dropped DLL 8 IoCs

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exee125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exesvchost.com

pid	process
1524	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
1524	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
1764	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
568	svchost.com
568	svchost.com
1524	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
568	svchost.com
568	svchost.com

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

description	ioc	process
File opened (read-only)	\??\S:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\U:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\V:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\I:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\J:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\Q:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\T:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\Y:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\Z:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\L:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\O:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\P:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\N:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\R:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\W:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\X:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\E:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\F:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\M:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\H:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\K:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\A:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\B:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\G:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

Drops file in Program Files directory 64 IoCs

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exesvchost.com

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTE.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GROOVEMN.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\IECONT~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\SETUPF~1\{AC76B~1\Setup.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\ink\mip.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Resource\Icons\SC_REA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~1\wab.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	svchost.com

Drops file in Windows directory 64 IoCs

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

description	ioc	process
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_77ec7be143d3727d_comdlg32.dll.mui_ac8e62f4	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-dns-client.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_47c3a7a7b5db2631.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-partitionmanager_31bf3856ad364e35_6.1.7601.17514_none_3fc218fad10f1ad4_partmgr.sys_fcac898c	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-s..ty-protectedstorage_31bf3856ad364e35_6.1.7600.16385_none_a43e06414a0fcb4b.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-t..s-runtime.resources_31bf3856ad364e35_6.1.7600.16385_es-es_620abae030f0959c.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_ro-ro_8fe226220f8cbade.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_6.1.7600.16385_de-de_965074b94313e034_webclnt.dll.mui_e8f04040	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..-microsoftsansserif_31bf3856ad364e35_6.1.7600.16385_none_850ef67c61bbadb6_micross.ttf_b13ae9de	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_664de2048e0b97ed_sti.dll.mui_00a4f15b	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-webservices.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0e8d75c5d7938376_webservices.dll.mui_eecc809d	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_hu-hu_330f86d55de64a40.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-mssign32-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_19ec38460d920c99.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_26cee700b53a673d_sdbinst.exe.mui_258ad624	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-verifier_31bf3856ad364e35_6.1.7600.16385_none_c9db8b862a010029_verifier.dll_7b1988f4	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-cdfs_31bf3856ad364e35_6.1.7600.16385_none_025c84b636a4ef6d.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-courier_31bf3856ad364e35_6.1.7600.16385_none_5283fef09ca6fa1a.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-p..ndprintui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d2c8fba0badc8a46_puiobj.dll.mui_b9c0c4d6	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-rasserver.resources_31bf3856ad364e35_6.1.7600.16385_en-us_7b176a691d8ef141.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-t..rk-msimtf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e4d46cbfc094f384_msimtf.dll.mui_e40b8b25	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2403bfdae4c06f52.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..on-authui.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_8c256fc0a6a20d36_authui.dll.mui_19b92789	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-r..intmapper.resources_31bf3856ad364e35_6.1.7600.16385_en-us_468dbb8913417112.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasbase.resources_31bf3856ad364e35_6.1.7600.16385_de-de_111bacf3e074578c_kmddsp.tsp.mui_80ddeedb	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasserver_31bf3856ad364e35_6.1.7601.17514_none_09cf3ec67e6c6b50_rasapi-repl.man_824b95f4	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-feclient_31bf3856ad364e35_6.1.7600.16385_none_beb0674eb8e86a51.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_es-es_48f4b6ddbd2973ac_msimsg.dll.mui_72e8994f	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b4e9412e316844af.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_226c70953d052250_scardsvr.dll.mui_5f6fb64f	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-userenv.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_664b6ce777be90cf.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_networking-mpssvc-svc.resources_31bf3856ad364e35_6.1.7601.17514_de-de_e07f4824fddc38e6_firewallapi.dll.mui_43c7a05b	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-i..rvice_mof.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_23a966a2fe2f7ffb_iscsidsc.mfl_20ed5374	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a18ee5b097220db7.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-setupapi.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1d64e900a235326e.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-smartcardksp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ba18a8ee6660c432.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-i..tional-codepage-870_31bf3856ad364e35_6.1.7600.16385_none_cec09376fc836892_c_870.nls_c0c54318	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-u..erservice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1f6e150bb06e1222_umpo.dll.mui_cac12e54	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-unimodem-config_31bf3856ad364e35_6.1.7600.16385_none_50f69335385bc360_uicom.dll_d72e5b75	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\wow64_microsoft-windows-syssetup_31bf3856ad364e35_6.1.7601.17514_none_d94b3b8ee2b71796_syssetup.dll_d4039292	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_th-th_d34f7dd5f675454a_msimsg.dll.mui_72e8994f	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_lv-lv_bfeef31b27ea4620.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-credui.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_62c39dbcabda5813.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-d..owmanager.resources_31bf3856ad364e35_6.1.7600.16385_es-es_05b98a45d5a86346_dwm.exe.mui_706e052f	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-rpc-local_31bf3856ad364e35_6.1.7601.17514_none_1220a4865bb3d9a0_rpcrt4.dll_5aa847dd	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-p..ndprintui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_754bce83add5924d_puiobj.dll.mui_b9c0c4d6	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_77ec7be143d3727d.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_ru-ru_923d4b5ed7926ec4.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_zh-tw_ac9edb6e6b20299f.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-usermodensi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_981164b3f9ab2ac9_nsisvc.dll.mui_237a741f	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-w..-encoding.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_671c48b9c28e5906.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d02acaa3e17e4bae_wininit.exe.mui_997435f5	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\wow64_microsoft-windows-netio-infrastructure_31bf3856ad364e35_6.1.7600.16385_none_bce508cf035f5001.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-comdlg32.resources_31bf3856ad364e35_6.1.7601.17514_pt-br_ee99ceab3ae3ff86.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-a..ce-router.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c6bb35d9d79285b4_activeds.dll.mui_67414db4	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-font-bitmap-small_31bf3856ad364e35_6.1.7600.16385_none_d7839341959a2de0_smallet.fon_f3d5df91	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-m..ents-mdac.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2d85a3923c5c7157_sqlsoldb.chm_9573a554	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_51f6d6941d367e01.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-x..ificateenrollmentui_31bf3856ad364e35_6.1.7600.16385_none_86663b85e279cca2_certenrollui.dll_7114147c	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\x86_microsoft-windows-x..nrollment.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4d28555a2326604c_certenrollctrl.exe.mui_3b48c5a6	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-f..itmap-ms_sans_serif_31bf3856ad364e35_6.1.7600.16385_none_ac9f9e10add68c8b_sserife.fon_dad8712a	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-lsa_31bf3856ad364e35_6.1.7601.17514_none_04709031736ac277_sspicli.dll_bcec1809	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-winbio.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f79b126d0518f4d5.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\wow64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_fc675397c4309dd0_prflbmsg.dll.mui_4caa0054	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-msxml30.resources_31bf3856ad364e35_6.1.7600.16385_en-us_95b3d36c607e479c_msxml3r.dll.mui_cd6e1e8f	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\winsxs\Backup\amd64_microsoft-windows-rpc-local.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f77bed28d763294e.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

532 vssadmin.exe

pid	process
532	vssadmin.exe

Modifies registry class 1 IoCs

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

pid process

1764 e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1216 vssvc.exe
Token: SeRestorePrivilege 1216 vssvc.exe
Token: SeAuditPrivilege 1216 vssvc.exe

pid	process
1764	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

description	pid	process
Token: SeBackupPrivilege	1216	vssvc.exe
Token: SeRestorePrivilege	1216	vssvc.exe
Token: SeAuditPrivilege	1216	vssvc.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exee125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exesvchost.comcmd.exe

description	pid	process	target process
PID 1524 wrote to memory of 1764	1524	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
PID 1524 wrote to memory of 1764	1524	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
PID 1524 wrote to memory of 1764	1524	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
PID 1524 wrote to memory of 1764	1524	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
PID 1764 wrote to memory of 568	1764	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	svchost.com
PID 1764 wrote to memory of 568	1764	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	svchost.com
PID 1764 wrote to memory of 568	1764	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	svchost.com
PID 1764 wrote to memory of 568	1764	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	svchost.com
PID 568 wrote to memory of 1240	568	svchost.com	cmd.exe
PID 568 wrote to memory of 1240	568	svchost.com	cmd.exe
PID 568 wrote to memory of 1240	568	svchost.com	cmd.exe
PID 568 wrote to memory of 1240	568	svchost.com	cmd.exe
PID 1240 wrote to memory of 532	1240	cmd.exe	vssadmin.exe
PID 1240 wrote to memory of 532	1240	cmd.exe	vssadmin.exe
PID 1240 wrote to memory of 532	1240	cmd.exe	vssadmin.exe
PID 1240 wrote to memory of 532	1240	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
"C:\Users\Admin\AppData\Local\Temp\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1524

C:\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1764

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:568

C:\Windows\SysWOW64\cmd.exe
C:\Windows\System32\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
5⤵
- Interacts with shadow copies
PID:532

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1216

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

File Deletion

T1107

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\ALLUSE~1\{90140~1\DW20.EXE
MD5
7bffdf305e41f531e6e963c5585b361e

SHA1
0a6a8d053af1f3be641f576e0f1012231596275f

SHA256
e826d5da72e45cc3cf73c79b0c112abad603a871b1ae5163d6145c77fc6deded

SHA512
cf0d81085fbdcd66141e1ed443d61e2c9e2af2109b78f0417f23b518fa5784b1ea3efd90a6fb92d88ca1b1fdd828631979fc1c033750e7cb7c5c56be54ec82f1

Download Submit
C:\MSOCache\ALLUSE~1\{90140~1\dwtrig20.exe
MD5
5ea5030df11d694bf9d0df8c4079ee37

SHA1
f4802bf1ce3649eeb0af9b4c5fecbb9305fb031f

SHA256
df4e6718dbc33b059d9faa5c7a8344375bdfe4808bcf4926ebbb00f8d7283dd0

SHA512
d6eec8151110323ab06963b1ee451e9c6ecaed6720421c9a5e9afb0efe2cf295a8cf083592fe83408e930f1b88c9ab3f968caba5a6d76a3aa41ee35cdfab80b5

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\ose.exe
MD5
100b5b7378227048bc1e1b82cb58635d

SHA1
805cff59e7dc4a42228c3b31ff945e6c0c844793

SHA256
1002540ac8ecfcca62bcb5afe7e247a08f5903bbdc8fcf090111e9658d28085d

SHA512
e464bdfe873bd99f118081bfac51fffe5c1e67b95d7af6a58e4090ed4cbac01baf2c8b161ef8e4ae2882e8d731bab7527001ac94b9f2433b0dca18847da92aae

Download Submit
C:\MSOCache\ALLUSE~1\{9A861~1\setup.exe
MD5
f546db5b23603cb1033666a040eb0ab8

SHA1
edc2a991e64f1bee0edff6750597a106cd34c248

SHA256
ad474d99802aa98da02ed4c88da79d00a98be528973ca13b48189709b030cfec

SHA512
26ea3c81f4b802f106d345b8b9a0f32da637247747e310fba0d46eb9dd8565e5a724b312eaf19ed0c256aaa4a6fe27e6e18eab61e36653edbf67207baaa8c0ec

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE
MD5
d4c158edc16d0878a3c227821461929a

SHA1
035d265d4880cf55c61968b03810621f9fe932b7

SHA256
05480d61d46b9b97cc06bdea27c9a6734a085ad129b240f695200d559a0e3ac0

SHA512
a6cdda1c93da5d7f2ecf64b14cdfcead0125a2f053858d2429e5f5113c3a72e02a08734741a03375a1cfcab4b089ef1deaf6fec026254448dec142fdd437379a

Download Submit
C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE
MD5
8baeee0719d79bece62f3b6ff8f9a897

SHA1
185e3ecfc142f929d8503eb170296d68325a53c4

SHA256
3eab94d984b013888e7c2aaf516347ad7ce60ab545446dac9d81a379213c3d0c

SHA512
b0d9698ff0f87f3ae4bcf2d42315c11e2dba6b7d90a6320775c5adcffce51a54498cf581960360333cb39877122df78b28a3f86b602ef4fae766f04b92a14e1b

Download Submit
C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE
MD5
33992252e9faa6ff868ed7aed3596b3b

SHA1
b440d282b9e2597bf70a88dc34ad9cb4bcbd37cb

SHA256
f5112af66850a620f46abe76a499d86c8ac77a9fe565a56c95919c5fc6a829e9

SHA512
d51a8270b7d150764151fc5ee13f80122f292a18c9189b03fa55c6eb380aff99b5913e92b479ef4f30f66e12629b35f833f4f38e7776e0f20dc1c1fd2217a891

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE
MD5
2368371384a01f5d26a1616738a4637f

SHA1
7f65d7f088f06222c0b33d7e0ca8b865a2a94d4e

SHA256
5d9742491fbec4ec3ae8dfd2d65812bed2f0daf5fe54d37a4b35c817610297db

SHA512
b3441ec083d0d7e821ec8329c540900c26402fc2d66138005b983a3dbb257fc4afcfc877bb9742836045b59f17b6525d05aece067cdac954ad2e3cc8684a7823

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE
MD5
efc0f01dd1778c34d16d21a517a8258a

SHA1
0bae66fcb9bfc1899ae875a117a4d18fca72407e

SHA256
93d299ef4a9a72a4dc95029e4c6636cf5dba8339f008bae62eca98ade1890ead

SHA512
a68a04e219dbfc82220ed6d5a61616f1d9abd70dad4a4436c53a625a73b77a7bd13f7eec1eae3797985023775fd5944d25bc096006ce2ea3f66bd59f6676d59c

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\DW\DW20.EXE
MD5
7bffdf305e41f531e6e963c5585b361e

SHA1
0a6a8d053af1f3be641f576e0f1012231596275f

SHA256
e826d5da72e45cc3cf73c79b0c112abad603a871b1ae5163d6145c77fc6deded

SHA512
cf0d81085fbdcd66141e1ed443d61e2c9e2af2109b78f0417f23b518fa5784b1ea3efd90a6fb92d88ca1b1fdd828631979fc1c033750e7cb7c5c56be54ec82f1

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE
MD5
341c2a927f4b7220a63af0ca6b7f3887

SHA1
e65f5a81f7a04fdd3b5874e528ba7f5944cd5441

SHA256
87a9bf4dd435399c6bbbfc0b5543538d0c5a2e33d8f374c63bf542bc9fa9cd8a

SHA512
5a8c7e2c605e937e4e4dfff0347ec576673d35abdf36c63fdc4aa0c1c48870d55b902429b2949c186b910e76e5e6c4986f7a1612e34a4f60ac7c8e0f9c71d99a

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE
MD5
f798867dde77bafe5285e979d4fe2ed6

SHA1
14b55d2440c6e6c683106a85f55cd7de73bac021

SHA256
9b021424edb7f761db762b0e4bfc05a569df605492a6964fd962d5e07f7b90e0

SHA512
fa53cd5de38734a3063d8f92b690cd4228397b5820cb60f7f36b07f1a735fd7c0ff9cf26e2ee01de89fd6f74e10fd908fc4767a246d9f875a5b81830942b8a38

Download Submit
C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE
MD5
d5daf9abad3166c668bea87625996be0

SHA1
7ac4aab5fa06c5b0254adb5006a7292e1d2126c7

SHA256
77e7df78f21322b7e035a091cabe90eb5a2929176bb675483043e5d02c548d58

SHA512
f4e0a71a3165a56b006cb34838ba766a15280f39bb1f3097f823718dda9689e02340d33c69bb03d113c3664daa2c7a94be824d7cb90d1b28c290ff2d7c8ee8cb

Download Submit
C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE
MD5
feacea73064b02895eff292d583992a5

SHA1
8b9d9ec8dd742bb34cd05848c0de5b6cb757b65c

SHA256
2195cd66177ef054fa340a3978129757331f78d651e5f34d57d5420737bf7de1

SHA512
e843cb06329f913b7ec0f0fddd0ee01dd6b90bcc21ce9fab4fc1e651999ee4a00bfac4566b89dbf2dac90e3d4493a02e352c60d072179485848e2077776f6715

Download Submit
C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE
MD5
f88528d87d8f8cbbd74c4bcea43192c8

SHA1
5834bfa07b1a772e98f6b64ac6dca03d41de4a39

SHA256
a7d8988a2458d19152bb28aad4eaf6eab08fcb6a0d6e423638a823de354ec192

SHA512
d2583d88d56100146f4835f83fbd914ed694607cc6363e27f78b49b17ee4532bc80ecf3fca88aa2bf3e21b813b1d2747dbc55fa3650eb46842572a8b06261190

Download Submit
C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE
MD5
dd1239a44b96b5362a59f6a6e41b57b7

SHA1
dbbaf02b0d117ec7e5ddb3777ef49232e71563ad

SHA256
3637207bd997b4948695470b657a0d34a6fd4da340227ffe610b82d130ff4f40

SHA512
2e41b1a7a8c7943ef8458facef958ff87fd91b475cd0412a7d13758e71c5d0c9d9d74b7ef01f553660151563e3b8823de50647cb498d18c6c84e8643c0cbcbcf

Download Submit
C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE
MD5
1f547fb2aa47a885c18aa2259b0de346

SHA1
a312732d524eaae0b590902fb776a67adc3fa0b4

SHA256
0e94a45ec7bea8bf611f6645b6ef67f8b2d3f6a6b9bf58e822c4efb9713d4e4a

SHA512
b16c33f5670a0e27d792ba9d2e2a1ad31a45a24ee4919e6de89ffbe302d3810bc18bb0d80199d3e186bfb3c76b7322c0d9f7817a2a97fffbaa3937ed0f678db7

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
MD5
5e2e10ed5362f576a7f203b4e0515f65

SHA1
c4805ca58ce9d1cb99ba74c43cceb6b4f4906d7f

SHA256
517b7ae5247c9207eff450e0a8699ed2fdf0fa5a2bf97c11c12252d8de58becc

SHA512
a21d154479886484383ee9b013e601339b56882782080a9a7e18ff25568630abed3ff07ec6b0e62eb35e4b0873aec7a76f4c29c10c51ea0f63b8cd5b470459b1

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{F4220~1\VC_RED~1.EXE
MD5
0735382b4f8d9d1c007f58c1c1f280ed

SHA1
c16f22c0ee98a99289378025a1deabf36ee4d948

SHA256
efc0aad354cef7921983a3d66d0f7ec1e83c39790590a33dde97b8ccaca3f5cd

SHA512
46b77af08b2994700fd7deb7506ebd05f8fc229638bd0aaea9fbdd14706c876d20bea05aba5aaece6924599618971f278652815623701e974577eafa4e8789a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
MD5
a994cfba920bb87b9322aeda48282d11

SHA1
dcdade9e535ec79f839537e7ed38499d258020b3

SHA256
8b15999cff808e9477d25bf0f839ac7c93fa4e62710fb6ae29d33787f1a05f12

SHA512
b68c6edc21c49b1a3ee24856fdf276d3c239d9320cbf8071aa8df4c5d89bdd81d9fe487d8dc1cfb73a3c0954db7b1b3d731c0aa004ce309da4380e783444bc39

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
MD5
a994cfba920bb87b9322aeda48282d11

SHA1
dcdade9e535ec79f839537e7ed38499d258020b3

SHA256
8b15999cff808e9477d25bf0f839ac7c93fa4e62710fb6ae29d33787f1a05f12

SHA512
b68c6edc21c49b1a3ee24856fdf276d3c239d9320cbf8071aa8df4c5d89bdd81d9fe487d8dc1cfb73a3c0954db7b1b3d731c0aa004ce309da4380e783444bc39

Download Submit
C:\Windows\svchost.com
MD5
92de9dd35422ed5eb81d1b18c07d748c

SHA1
6e4571c89618ac100d36e8965cc21b1c78ef0575

SHA256
a0d82923b587f61991b80d5769aa91727d62c06e46ad0146b1fb9fa2f9839118

SHA512
e0712a1fe820c0dd12332fb5f53cfc7a8e60882b5cf193a36b8dd10af02f95fe26cb0db3b4cad7b516b6d6cdf51ed08f0949c85b88a17ae25874448342013c3e

Download Submit
C:\Windows\svchost.com
MD5
92de9dd35422ed5eb81d1b18c07d748c

SHA1
6e4571c89618ac100d36e8965cc21b1c78ef0575

SHA256
a0d82923b587f61991b80d5769aa91727d62c06e46ad0146b1fb9fa2f9839118

SHA512
e0712a1fe820c0dd12332fb5f53cfc7a8e60882b5cf193a36b8dd10af02f95fe26cb0db3b4cad7b516b6d6cdf51ed08f0949c85b88a17ae25874448342013c3e

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE
MD5
d4c158edc16d0878a3c227821461929a

SHA1
035d265d4880cf55c61968b03810621f9fe932b7

SHA256
05480d61d46b9b97cc06bdea27c9a6734a085ad129b240f695200d559a0e3ac0

SHA512
a6cdda1c93da5d7f2ecf64b14cdfcead0125a2f053858d2429e5f5113c3a72e02a08734741a03375a1cfcab4b089ef1deaf6fec026254448dec142fdd437379a

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE
MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE
MD5
2368371384a01f5d26a1616738a4637f

SHA1
7f65d7f088f06222c0b33d7e0ca8b865a2a94d4e

SHA256
5d9742491fbec4ec3ae8dfd2d65812bed2f0daf5fe54d37a4b35c817610297db

SHA512
b3441ec083d0d7e821ec8329c540900c26402fc2d66138005b983a3dbb257fc4afcfc877bb9742836045b59f17b6525d05aece067cdac954ad2e3cc8684a7823

Download Submit
\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\LICLUA.EXE
MD5
341c2a927f4b7220a63af0ca6b7f3887

SHA1
e65f5a81f7a04fdd3b5874e528ba7f5944cd5441

SHA256
87a9bf4dd435399c6bbbfc0b5543538d0c5a2e33d8f374c63bf542bc9fa9cd8a

SHA512
5a8c7e2c605e937e4e4dfff0347ec576673d35abdf36c63fdc4aa0c1c48870d55b902429b2949c186b910e76e5e6c4986f7a1612e34a4f60ac7c8e0f9c71d99a

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
MD5
a994cfba920bb87b9322aeda48282d11

SHA1
dcdade9e535ec79f839537e7ed38499d258020b3

SHA256
8b15999cff808e9477d25bf0f839ac7c93fa4e62710fb6ae29d33787f1a05f12

SHA512
b68c6edc21c49b1a3ee24856fdf276d3c239d9320cbf8071aa8df4c5d89bdd81d9fe487d8dc1cfb73a3c0954db7b1b3d731c0aa004ce309da4380e783444bc39

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
MD5
a994cfba920bb87b9322aeda48282d11

SHA1
dcdade9e535ec79f839537e7ed38499d258020b3

SHA256
8b15999cff808e9477d25bf0f839ac7c93fa4e62710fb6ae29d33787f1a05f12

SHA512
b68c6edc21c49b1a3ee24856fdf276d3c239d9320cbf8071aa8df4c5d89bdd81d9fe487d8dc1cfb73a3c0954db7b1b3d731c0aa004ce309da4380e783444bc39

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
MD5
a994cfba920bb87b9322aeda48282d11

SHA1
dcdade9e535ec79f839537e7ed38499d258020b3

SHA256
8b15999cff808e9477d25bf0f839ac7c93fa4e62710fb6ae29d33787f1a05f12

SHA512
b68c6edc21c49b1a3ee24856fdf276d3c239d9320cbf8071aa8df4c5d89bdd81d9fe487d8dc1cfb73a3c0954db7b1b3d731c0aa004ce309da4380e783444bc39

Download Submit
memory/1524-54-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads