neshta | e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37

Analysis

max time kernel
123s
max time network
162s
platform
windows10_x64
resource
win10-en-20211208
submitted
24-01-2022 00:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
Size

198KB
MD5

858c29efee084e86616b21fdc4d2a3de
SHA1

d642f7ecda3fa135761d68eb20f44d66eba798fa
SHA256

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37
SHA512

673ffc06a6c2b66808c4b174d9b90d440b320b63c4076731bf6f96fbf33ef56e8930b4ce0ec4b0e9f710f1db952cb6b1bb178a1540d6d76950dd9c646e22e1e1

Score

10^/10

neshta sodinokibi 19 29 persistence ransomware spyware stealer

Malware Config

Extracted

Family

sodinokibi

Botnet

Campaign

schluesseldienste-hannover.de

alpesiberie.com

bratek-immobilien.de

bcmets.info

log-barn.co.uk

diverfiestas.com.es

nexstagefinancial.com

mundo-pieces-auto.fr

marmarabasin.com

walterman.es

juergenblaetz.de

centuryvisionglobal.com

witraz.pl

aslog.fr

qandmmusiccenter.com

awag-blog.de

domilivefurniture.com

penumbuhrambutkeiskei.com

from02pro.com

teamsegeln.ch

Attributes

net
true
pid
19
prc
mysql.exe
ransom_oneliner
All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions
ransom_template
---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on you computer has expansion {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decryptor.top/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} Extension name: {EXT} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!
sub
29

Signatures

Detect Neshta Payload 13 IoCs

Processes:

resource	yara_rule
C:\Windows\svchost.com	family_neshta
C:\Windows\svchost.com	family_neshta
C:\odt\OFFICE~1.EXE	family_neshta
C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	family_neshta
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	family_neshta
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	family_neshta
C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	family_neshta
C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	family_neshta
C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{F4220~1\VC_RED~1.EXE	family_neshta
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	family_neshta

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
ransomware sodinokibi

Sodinokibi/Revil sample 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	family_sodinokobi
C:\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	family_sodinokobi

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exesvchost.com

pid process

1316 e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
1536 svchost.com
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

description	ioc	process
File opened (read-only)	\??\H:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\O:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\Q:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\S:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\T:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\W:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\F:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\L:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\P:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\R:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\U:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\V:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\Y:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\E:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\B:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\G:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\J:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\N:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\Z:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\A:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\K:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\M:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\X:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened (read-only)	\??\I:	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

Drops file in Program Files directory 64 IoCs

Processes:

svchost.come125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\WinMail.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	svchost.com
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOBD5D~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmprph.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	svchost.com
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\WinMail.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~4\ACCESS~1\wordpad.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{F4220~1\VC_RED~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	svchost.com

Drops file in Windows directory 64 IoCs

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

description	ioc	process
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-dns-client-minwin_31bf3856ad364e35_10.0.15063.0_none_a69f8cf95bf4534e_dnsrslvr.dll_faf65b7a	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-f..e-nirmalaui_regular_31bf3856ad364e35_10.0.15063.0_none_7ed69818195848c4.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_1758c8aaa6a3ed16_dsreg.dll.mui_5d9efc7e	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-h..p-provsvc.resources_31bf3856ad364e35_10.0.15063.0_es-es_8ead935787359bfd.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-netapi32_31bf3856ad364e35_10.0.15063.0_none_a89c9e9e6ebf5995_netapi32.dll_8b1e859a	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft.windows.winhttp.resources_31bf3856ad364e35_6.0.15063.0_de-de_c50ed7ff94ebd690_winhttp.dll.mui_f661192f	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_el-gr_a0ff2691894d4ea2.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_fr-ca_3c52ec2480e76006_comctl32.dll.mui_0da4e682	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_sk-sk_4071e5a8ddae1035.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft-windows-t..services-publicapis_31bf3856ad364e35_10.0.15063.0_none_7c26291346c6844d_wtsapi32.dll_470d4d41	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-c..temminpnp.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_31d8610f74e14b65_drvcfg.exe.mui_ff2bc967	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_pt-pt_5ab3cf3803b28fdf_msimsg.dll.mui_72e8994f	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-netlogon.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_6fa7a65a14e4e298_netlogon.dll.mui_ecbeb9bd	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..-webauthn.resources_31bf3856ad364e35_10.0.15063.0_es-es_3218fa3615366fbd.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-time-service_31bf3856ad364e35_10.0.15063.0_none_99bb3ce8a6195e97.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_hid-user.resources_31bf3856ad364e35_10.0.15063.0_de-de_71a6f7b87cc5aa6a_hidserv.dll.mui_561adfc8	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_967b0826e973a912_iscsidsc.dll.mui_6acb64a6	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..re-memorydiagnostic_31bf3856ad364e35_10.0.15063.0_none_e94927a33d6c1426_memtest.efi_01d7fdbb	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-g..licy-base.resources_31bf3856ad364e35_10.0.15063.0_de-de_29579edbbad6dd55_gpsvc.dll.mui_0c160ac2	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver_31bf3856ad364e35_10.0.15063.0_none_bcbd1290a09b9a77_iprtprio.dll_5829c3c7	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winsock-core.resources_31bf3856ad364e35_10.0.15063.0_es-es_5cc7f678b75c45f4.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_cs-cz_8efb8f901141355a_memtest.exe.mui_77b8cbcc	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-com-base_31bf3856ad364e35_10.0.15063.0_none_2956ba0293b4f9a6.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-c..ermodepnp.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_2b6c8e7c08218e26.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-deviceguard-gpext_31bf3856ad364e35_10.0.15063.0_none_7bf15777315a0972_dggpext.dll_0c91d307	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-fixed_31bf3856ad364e35_10.0.15063.0_none_9023bb87676e429a_85f874.fon_2b942d95	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_de-de_cbe51fcec4ccd94a_userdeviceregistration.ngc.dll.mui_d2c6ca95	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_cs-cz_e3434cec2591af28.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_ja-jp_9d171755de4e33ec.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-oem_31bf3856ad364e35_10.0.15063.0_none_0e77f624e73557a1_8514oemg.fon_dbdce127	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..gon-tools.resources_31bf3856ad364e35_10.0.15063.0_en-us_26c069caca82e24a.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft.windows.gdiplus.systemcopy_31bf3856ad364e35_10.0.15063.0_none_f7ee6fbe2edc3d66.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-gdi32full_31bf3856ad364e35_10.0.15063.0_none_66ff4ca96011b0ac.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-security-schannel_31bf3856ad364e35_10.0.15063.0_none_332a24478e119029_schannel.dll_7364eaa8	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shsvcs.resources_31bf3856ad364e35_10.0.15063.0_de-de_000f55c92a390fac.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_8cee407ae5edcfbb_wiaservc.dll.mui_54051b53	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lsa.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_3a3e806dc2631896.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-sens-service.resources_31bf3856ad364e35_10.0.15063.0_es-es_26211a1d5afae1dd_sens.dll.mui_64739194	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-time-service.resources_31bf3856ad364e35_10.0.15063.0_es-es_63e502efcd134d2d_w32time.dll.mui_b382d4b4	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-wininit.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_f8fc3ce2364f0716.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.15063.0_en-us_987c8d6bc746e508_firewallapi.dll.mui_43c7a05b	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_f5dc2ec982476ba8_iscsiconnection.cdxml_1f2347b5	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-ui-xaml-inkcontrols_31bf3856ad364e35_10.0.15063.0_none_e9be2557d1df757f_windows.ui.xaml.inkcontrols.dll_523c865d	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmpdui.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_c3d533af484301a2.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_lv-lv_182c8e682a72c4dc.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_tr-tr_2f831b67bffff9cc_comctl32.dll.mui_0da4e682	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-usermodensi_31bf3856ad364e35_10.0.15063.0_none_8375fc1900429a0a_nsisvc.dll_7733cdbc	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..ient-core.resources_31bf3856ad364e35_10.0.15063.0_es-es_1536008d1728d405.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_fr-fr_fc2f6b036792d0da_comctl32.dll.mui_0da4e682	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_lt-lt_9c9ee934ae6a9d99_comctl32.dll.mui_0da4e682	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-usermodensi.resources_31bf3856ad364e35_10.0.15063.0_en-us_57b999b44d02ade0_nsisvc.dll.mui_237a741f	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft-windows-a..on-authui-component_31bf3856ad364e35_10.0.15063.0_none_91cc889b9049023b_authui.dll_05ff9fd2	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_fr-fr_43dca1da7c0ef9e0.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-a..llservice.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_1164be3dcef90997.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-keyiso.resources_31bf3856ad364e35_10.0.15063.0_es-es_25bee1b0e1672027_keyiso.dll.mui_4bbf12ff	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_10.0.15063.0_es-es_effb6eaa34ff2c34_mofcomp.exe.mui_35badf56	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_7f4f15fec6b30f50.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-client-li..m-service.resources_31bf3856ad364e35_10.0.15063.0_de-de_aa72c79d3365a91b.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..memanager.resources_31bf3856ad364e35_10.0.15063.0_de-de_0cb68f8bd1dc0cd2_volmgrx.sys.mui_b0c205d7	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_cga80737.fon_2e43d167	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\amd64_microsoft-windows-smbminirdr_31bf3856ad364e35_10.0.15063.0_none_90a5466e89ec288b.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_21ad72fcdb04af11_userdeviceregistration.ngc.dll.mui_d2c6ca95	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\wow64_microsoft-windows-w..cture-bsp.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_181a08478e2b3970_mswsock.dll.mui_d7c2a730	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
File opened for modification	C:\Windows\WinSxS\Backup\x86_microsoft-windows-comdlg32_31bf3856ad364e35_10.0.15063.0_none_6aa64f572618dbd7.manifest	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

4056 vssadmin.exe

pid	process
4056	vssadmin.exe

Modifies registry class 2 IoCs

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exee125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

pid	process
1316	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
1316	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 1796 vssvc.exe
Token: SeRestorePrivilege 1796 vssvc.exe
Token: SeAuditPrivilege 1796 vssvc.exe

description	pid	process
Token: SeBackupPrivilege	1796	vssvc.exe
Token: SeRestorePrivilege	1796	vssvc.exe
Token: SeAuditPrivilege	1796	vssvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exee125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exesvchost.comcmd.exe

description	pid	process	target process
PID 2912 wrote to memory of 1316	2912	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
PID 2912 wrote to memory of 1316	2912	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
PID 2912 wrote to memory of 1316	2912	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
PID 1316 wrote to memory of 1536	1316	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	svchost.com
PID 1316 wrote to memory of 1536	1316	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	svchost.com
PID 1316 wrote to memory of 1536	1316	e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe	svchost.com
PID 1536 wrote to memory of 3720	1536	svchost.com	cmd.exe
PID 1536 wrote to memory of 3720	1536	svchost.com	cmd.exe
PID 1536 wrote to memory of 3720	1536	svchost.com	cmd.exe
PID 3720 wrote to memory of 4056	3720	cmd.exe	vssadmin.exe
PID 3720 wrote to memory of 4056	3720	cmd.exe	vssadmin.exe
PID 3720 wrote to memory of 4056	3720	cmd.exe	vssadmin.exe

C:\Users\Admin\AppData\Local\Temp\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
"C:\Users\Admin\AppData\Local\Temp\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2912

C:\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe"
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1316

C:\Windows\svchost.com
"C:\Windows\svchost.com" "C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1536

C:\Windows\SysWOW64\cmd.exe
C:\Windows\System32\cmd.exe /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Suspicious use of WriteProcessMemory
PID:3720

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /All /Quiet
5⤵
- Interacts with shadow copies
PID:4056

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1796

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Privilege Escalation

Defense Evasion

Modify Registry

T1112

File Deletion

T1107

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE
MD5
b037307e29aa4af87994396982863bec

SHA1
ccd457d49009b9b73e21a74e095b2fb799c0692b

SHA256
43e9af0216a81196ac032b6435ba38e033446f658516257b6babf089865de92f

SHA512
cd80ef72ae109cd49d868c884a05ac6ade4ef8259c713af861761dfcd86edf038ce6c86aaa890663bfbf1d3002467143162fa6eebc2fdd843e662a69835f8e01

Download Submit
C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\armsvc.exe
MD5
03da81bd82595fef7ff51728efe1205b

SHA1
87f7eb2813bc9e13750384cdec376115dfca7198

SHA256
bd3091207e51be77cb9586561ba5adf2d21d79cd6a2401aee5d3ca05771115a8

SHA512
d5c141d133699de2c545b8a59f694eb65ae27e8d317c9f4a61ffd704d8a50d3a75622c70ef86b31092a6e6c79fa3794dd5dc382ee7cc74fe8d44f08ee0d50245

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE
MD5
0e8be2c68e210310b0cb290d64a7ef90

SHA1
5951db9d08b97ca8082d365dbc34ea65e1fcf6eb

SHA256
d8e37aae2699dd8b8732b2ad45db7a41c32dcba1b68c26ee4bec9f17b2ede7ac

SHA512
8853f668d56350e913e7fbfbfbb26d5c62f19be6ec659593093f2c7ef1ef23e1ca6ffc48591bae29d4db8338f04c1afd9c241392c4236f8a6c0529a593f8e0b0

Download Submit
C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE
MD5
d0d894ec824b3bfe284da54780bdcf00

SHA1
a08eaa4a56db8d719eabdbde5f31a28e63d4d2ed

SHA256
456c021799b9e1edde791001d5f0e958b98969dff91705d597d329ab27960edf

SHA512
c9f9bbb70f69eea20d63edfa1d53bd01fe524ce39ddd42530b19f887f9a13fb937573f43df3869cc331ac9d446377511faf29543b11245574e069d313877a98e

Download Submit
C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe
MD5
a3b12b063dbb328e39e02d5a05285441

SHA1
dc7e62de99336f34b4e42e0ba5bd70b32a89651b

SHA256
0dd46c290c1f89f4f792a0e69de660af15e7312518e6a50c924f78df84d06a95

SHA512
dad7f0ba39ba22160ea5c59130982573866c4245480b2e4212ad3df83b5ce3c9c3296cf180bd582f2c32c844317030dcf7518056b05881b09d049105a87f2dea

Download Submit
C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE
MD5
81b29f62422cd1fcc08b93326a1bc2df

SHA1
14e416bf2e85b50991effa9b66c083654d80c7d5

SHA256
de3642489ba5dc9b713acaa3b2cf28aa5ec93c7538b0de01c6297df4e9f0d214

SHA512
18e38d2b95ddda22ac2e33689926fd549d882d98da75384ae72b16f3964ad0a2e49f8dff001cb1b9a188f0b802d203fc16e776c00e66b655e2fcb5da728a7dc8

Download Submit
C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
MD5
f741c83a217c32917c1caa554a717459

SHA1
9aabaee146fc72f462fbb3d664fbc60f6c47082f

SHA256
e6be910f9ea35e2779523a8d531ace0d449259938e5419f94a79908945c7a109

SHA512
d64df09c688bd66db2ed837e09911bffe3b60f99d0b03991703396470e068b436d86a408e486077eb5ad7e5828122f53c6a621f3121cbb4cd9f85072193490ce

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE
MD5
02973dbeae74f92af18274be31535a2a

SHA1
cd8a7ce9cab1fb07da6b88abe12178d07f19af8f

SHA256
c80ee122dbfe04ef872cca4fe63a130909d9f7d14822f6fda21149f79f78bb2d

SHA512
48515f62af2b1991fb7b1adb3c362b4a4fd7dbf5a5503a13bd45996a8a16822d3ca09d9c83599b2f94c2287084b33f2b5fb54fb52113563c27fd5a8b87782a0e

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE
MD5
f741c83a217c32917c1caa554a717459

SHA1
9aabaee146fc72f462fbb3d664fbc60f6c47082f

SHA256
e6be910f9ea35e2779523a8d531ace0d449259938e5419f94a79908945c7a109

SHA512
d64df09c688bd66db2ed837e09911bffe3b60f99d0b03991703396470e068b436d86a408e486077eb5ad7e5828122f53c6a621f3121cbb4cd9f85072193490ce

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{F4220~1\VC_RED~1.EXE
MD5
b8e1a5ed41e1440f5793134d837c99cb

SHA1
1102f59165fc7605156fb65dca48168d81af2fb7

SHA256
22caa8c595be7b4067bec256a37618eda725962b4c36ad256d9f67b7b974a75c

SHA512
4681d6f861cec8a59ed40cd3f6ef94cd0645173ce059c97609d3c025926469c5fbaf2cc6e290950868b7bf65fd4d9c6aa0762e4e0846e2354935d57968ded9f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
MD5
a994cfba920bb87b9322aeda48282d11

SHA1
dcdade9e535ec79f839537e7ed38499d258020b3

SHA256
8b15999cff808e9477d25bf0f839ac7c93fa4e62710fb6ae29d33787f1a05f12

SHA512
b68c6edc21c49b1a3ee24856fdf276d3c239d9320cbf8071aa8df4c5d89bdd81d9fe487d8dc1cfb73a3c0954db7b1b3d731c0aa004ce309da4380e783444bc39

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\e125ef182c6de161f75933a552c39677d842d854c317da92518191054fd83f37.exe
MD5
a994cfba920bb87b9322aeda48282d11

SHA1
dcdade9e535ec79f839537e7ed38499d258020b3

SHA256
8b15999cff808e9477d25bf0f839ac7c93fa4e62710fb6ae29d33787f1a05f12

SHA512
b68c6edc21c49b1a3ee24856fdf276d3c239d9320cbf8071aa8df4c5d89bdd81d9fe487d8dc1cfb73a3c0954db7b1b3d731c0aa004ce309da4380e783444bc39

Download Submit
C:\Windows\svchost.com
MD5
92de9dd35422ed5eb81d1b18c07d748c

SHA1
6e4571c89618ac100d36e8965cc21b1c78ef0575

SHA256
a0d82923b587f61991b80d5769aa91727d62c06e46ad0146b1fb9fa2f9839118

SHA512
e0712a1fe820c0dd12332fb5f53cfc7a8e60882b5cf193a36b8dd10af02f95fe26cb0db3b4cad7b516b6d6cdf51ed08f0949c85b88a17ae25874448342013c3e

Download Submit
C:\Windows\svchost.com
MD5
92de9dd35422ed5eb81d1b18c07d748c

SHA1
6e4571c89618ac100d36e8965cc21b1c78ef0575

SHA256
a0d82923b587f61991b80d5769aa91727d62c06e46ad0146b1fb9fa2f9839118

SHA512
e0712a1fe820c0dd12332fb5f53cfc7a8e60882b5cf193a36b8dd10af02f95fe26cb0db3b4cad7b516b6d6cdf51ed08f0949c85b88a17ae25874448342013c3e

Download Submit
C:\odt\OFFICE~1.EXE
MD5
6c0a9241dda1b6c3f145e0ef34e319e3

SHA1
21bfeadf7d298297efef944e9ddc18f1db67ce79

SHA256
9859029cd15d909f8f5e5fd96fd6c7899ebe81614892b90d3fa557b6c2197863

SHA512
05d39cd5d4f29ea8c9922bfac22606baa3f2c53720623f6ab9eaa1ea737e1f20ca27e3bf54812d17e9a63177dd25d2b4d9a2d02b3e0af0e5bbeb4e4fbb992bc3

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads