ryuk | ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4

General

Target

ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe
Size

72KB
MD5

777d9d83da40ed1481d9f0646b4b0a3d
SHA1

6c817e64a04620eddd9b73ed894a76afac484b94
SHA256

ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4
SHA512

f0ae9cd13ec35b7cfa4dda91637c683b1074faff99fbff8448b8dd90fac2c0be1fa2304f90bbea4695fa196724f36767f2f40f5a1e6a95e3cf6c14ecea2754b6

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Executes dropped EXE 1 IoCs

Processes:

hlxbvcB.exe

pid process

1752 hlxbvcB.exe

pid	process
1752	hlxbvcB.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exehlxbvcB.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	hlxbvcB.exe

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 49 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4276"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.284093"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.164353"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.136488"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899708590701098"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4160"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exehlxbvcB.exe

pid	process
1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe
1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe
1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe
1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe
1752	hlxbvcB.exe
1752	hlxbvcB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exehlxbvcB.exe

description	pid	process
Token: SeBackupPrivilege	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe
Token: SeBackupPrivilege	1752	hlxbvcB.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exenet.exenet.exenet.exenet.exehlxbvcB.exenet.exenet.exe

description	pid	process	target process
PID 1860 wrote to memory of 1752	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	hlxbvcB.exe
PID 1860 wrote to memory of 1752	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	hlxbvcB.exe
PID 1860 wrote to memory of 1752	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	hlxbvcB.exe
PID 1860 wrote to memory of 3728	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	net.exe
PID 1860 wrote to memory of 3728	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	net.exe
PID 1860 wrote to memory of 3728	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	net.exe
PID 1860 wrote to memory of 3552	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	net.exe
PID 1860 wrote to memory of 3552	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	net.exe
PID 1860 wrote to memory of 3552	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	net.exe
PID 1860 wrote to memory of 3288	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	net.exe
PID 1860 wrote to memory of 3288	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	net.exe
PID 1860 wrote to memory of 3288	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	net.exe
PID 1860 wrote to memory of 2236	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	net.exe
PID 1860 wrote to memory of 2236	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	net.exe
PID 1860 wrote to memory of 2236	1860	ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe	net.exe
PID 3552 wrote to memory of 3448	3552	net.exe	net1.exe
PID 3552 wrote to memory of 3448	3552	net.exe	net1.exe
PID 3552 wrote to memory of 3448	3552	net.exe	net1.exe
PID 2236 wrote to memory of 2452	2236	net.exe	net1.exe
PID 2236 wrote to memory of 2452	2236	net.exe	net1.exe
PID 2236 wrote to memory of 2452	2236	net.exe	net1.exe
PID 3288 wrote to memory of 3040	3288	net.exe	net1.exe
PID 3288 wrote to memory of 3040	3288	net.exe	net1.exe
PID 3288 wrote to memory of 3040	3288	net.exe	net1.exe
PID 3728 wrote to memory of 2580	3728	net.exe	net1.exe
PID 3728 wrote to memory of 2580	3728	net.exe	net1.exe
PID 3728 wrote to memory of 2580	3728	net.exe	net1.exe
PID 1752 wrote to memory of 4236	1752	hlxbvcB.exe	net.exe
PID 1752 wrote to memory of 4236	1752	hlxbvcB.exe	net.exe
PID 1752 wrote to memory of 4236	1752	hlxbvcB.exe	net.exe
PID 4236 wrote to memory of 4288	4236	net.exe	net1.exe
PID 4236 wrote to memory of 4288	4236	net.exe	net1.exe
PID 4236 wrote to memory of 4288	4236	net.exe	net1.exe
PID 1752 wrote to memory of 4312	1752	hlxbvcB.exe	net.exe
PID 1752 wrote to memory of 4312	1752	hlxbvcB.exe	net.exe
PID 1752 wrote to memory of 4312	1752	hlxbvcB.exe	net.exe
PID 4312 wrote to memory of 4376	4312	net.exe	net1.exe
PID 4312 wrote to memory of 4376	4312	net.exe	net1.exe
PID 4312 wrote to memory of 4376	4312	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe
"C:\Users\Admin\AppData\Local\Temp\ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860

C:\Users\Admin\AppData\Local\Temp\hlxbvcB.exe
"C:\Users\Admin\AppData\Local\Temp\hlxbvcB.exe" 8 LAN
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
3⤵
- Suspicious use of WriteProcessMemory
PID:4236

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
4⤵
PID:4288

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
3⤵
- Suspicious use of WriteProcessMemory
PID:4312

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
4⤵
PID:4376

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3552

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:3448

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:2580

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3288

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:3040

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2236

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:2452

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:2492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_0d751396-3164-4736-b931-4f59d47ff1f2
MD5
93a5aadeec082ffc1bca5aa27af70f52

SHA1
47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

SHA256
a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

SHA512
df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

Download Submit
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
MD5
62429300ef3f095ae37a58b737c60ab5

SHA1
6036c4e454eb6fed69504e7a5ae2227153757e93

SHA256
dbcb799862fb04f74c3a3fd880a35a3f87c1a5d87ee57235f84c33bf51a97b46

SHA512
028db4e3928a3d7a4eb7377a423d700e1c9c52c0da147690ae3d373274e08b20896d4732b1e647f441be74fce9dafa5f17434f79bdb977595a635a7cafd182a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\hlxbvcB.exe
MD5
777d9d83da40ed1481d9f0646b4b0a3d

SHA1
6c817e64a04620eddd9b73ed894a76afac484b94

SHA256
ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4

SHA512
f0ae9cd13ec35b7cfa4dda91637c683b1074faff99fbff8448b8dd90fac2c0be1fa2304f90bbea4695fa196724f36767f2f40f5a1e6a95e3cf6c14ecea2754b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\hlxbvcB.exe
MD5
777d9d83da40ed1481d9f0646b4b0a3d

SHA1
6c817e64a04620eddd9b73ed894a76afac484b94

SHA256
ddc41e15773815f293b5a61e505e37dff0e05e9e195e4dd2e2eaab932b9582d4

SHA512
f0ae9cd13ec35b7cfa4dda91637c683b1074faff99fbff8448b8dd90fac2c0be1fa2304f90bbea4695fa196724f36767f2f40f5a1e6a95e3cf6c14ecea2754b6

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads