e6b6edeaf9b53a6acae9b1814961b48a95e865d93d157738f5e248ad529225ce

Analysis

max time kernel
172s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 06:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e6b6edeaf9b53a6acae9b1814961b48a95e865d93d157738f5e248ad529225ce.exe
Size

67KB
MD5

6eddc720e728994991c2fd59d4286760
SHA1

723ffedcfd5c2e92426adb3740d1df4925d3d45b
SHA256

e6b6edeaf9b53a6acae9b1814961b48a95e865d93d157738f5e248ad529225ce
SHA512

46fae0760e6b68c86f5ef4a5db01b8e64b0cd2b99f4e19f8d84b2b8816337c87c8302399a9066608fe7b24fe930e93aacda7c59459f0ef3e57eb37fdc698da46
SSDEEP

1536:sr+Fum5LMI+WTJjcsnXMcpm/zOxJXKJetu:sr+Fu2II+HiXMcI/AKJetu

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	e6b6edeaf9b53a6acae9b1814961b48a95e865d93d157738f5e248ad529225ce.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File created	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe

Executes dropped EXE 4 IoCs

pid	Process
1212	winlogon.exe
1512	AE 0124 BE.exe
1340	winlogon.exe
1480	winlogon.exe

Loads dropped DLL 8 IoCs

pid	Process
1380	e6b6edeaf9b53a6acae9b1814961b48a95e865d93d157738f5e248ad529225ce.exe
1380	e6b6edeaf9b53a6acae9b1814961b48a95e865d93d157738f5e248ad529225ce.exe
1212	winlogon.exe
1212	winlogon.exe
1340	winlogon.exe
1512	AE 0124 BE.exe
1512	AE 0124 BE.exe
1480	winlogon.exe

Drops desktop.ini file(s) 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Media\Quirky\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Sonata\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Calligraphy\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Landscape\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Festival\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Garden\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Delta\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Link\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Link\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Heritage\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Cityscape\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Raga\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Offline Web Pages\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Afternoon\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Savanna\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Characters\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	AE 0124 BE.exe

Drops autorun.inf file 1 TTPs 25 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\I:\Autorun.inf	winlogon.exe
File opened for modification	\??\P:\Autorun.inf	winlogon.exe
File opened for modification	\??\U:\Autorun.inf	winlogon.exe
File opened for modification	\??\X:\Autorun.inf	winlogon.exe
File opened for modification	\??\Z:\Autorun.inf	winlogon.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	AE 0124 BE.exe
File opened for modification	\??\E:\Autorun.inf	winlogon.exe
File opened for modification	\??\K:\Autorun.inf	winlogon.exe
File opened for modification	\??\Q:\Autorun.inf	winlogon.exe
File opened for modification	\??\R:\Autorun.inf	winlogon.exe
File opened for modification	\??\S:\Autorun.inf	winlogon.exe
File opened for modification	\??\G:\Autorun.inf	winlogon.exe
File opened for modification	\??\H:\Autorun.inf	winlogon.exe
File opened for modification	\??\L:\Autorun.inf	winlogon.exe
File opened for modification	\??\N:\Autorun.inf	winlogon.exe
File opened for modification	\??\Y:\Autorun.inf	winlogon.exe
File opened for modification	\??\F:\Autorun.inf	winlogon.exe
File opened for modification	D:\Autorun.inf	winlogon.exe
File opened for modification	\??\J:\Autorun.inf	winlogon.exe
File opened for modification	\??\M:\Autorun.inf	winlogon.exe
File opened for modification	\??\O:\Autorun.inf	winlogon.exe
File opened for modification	\??\T:\Autorun.inf	winlogon.exe
File opened for modification	\??\V:\Autorun.inf	winlogon.exe
File opened for modification	\??\W:\Autorun.inf	winlogon.exe
File opened for modification	C:\Autorun.inf	winlogon.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\regedit.exe	AE 0124 BE.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\UIAutomationClients#	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\MSDTC Bridge 4.0.0.0\0416\_TransactionBridgePerfCounters.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\SMSvcHost 4.0.0.0\0014\_SMSvcHostPerfCounters.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Providers\App_LocalResources\manageProviders.aspx.es.resx	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_Code	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Drawing.Design.resources\2.0.0.0_es_b03f5f7f11d50a3a	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\fbc05b5b05dc6366b02b8e2f77d080f1	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\Power\ja-JP\RS_DisableScreensaver.psd1	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\Windows\it-IT\hmeshare.H1S	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-OfflineFiles-Package~31bf3856ad364e35~amd64~de-DE~6.1.7601.17514.cat	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.2486c0f5#\8e1a0ff5d2f22bb7de74bb93081c8fba	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\cvgasys.fon	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\Power\en-US\RS_DisableUSBSelective.psd1	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\Windows\es-ES\sysman.h1s	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\PERFLIB\0409\perfh.dat	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\es	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine.resources	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Configuratio#\fcf35536476614410e0b0bd0e412199e\System.Configuration.Install.ni.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.Mobile\561d5401d0521bc81746d7c53a539585\System.Web.Mobile.ni.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Entity	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1033\SetupResources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-MSMQ-Client-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.mum	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\6.1.0.0__31bf3856ad364e35	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources	AE 0124 BE.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\WindowsColorSystem.adml	AE 0124 BE.exe
File opened for modification	C:\Windows\schemas\EAPHost\eaphostconfig.xsd	AE 0124 BE.exe
File opened for modification	C:\Windows\servicing\SQM	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_es_31bf3856ad364e35	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\MSDTC\0410\msdtcprf.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\EditAppSetting.aspx.es.resx	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\de\SqlPersistenceService_Schema.sql	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\es\aspnet_regbrowsers.resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\PolicyDefinitions\de-DE\AddRemovePrograms.adml	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\system.identitymodel.selectors.resources\3.0.0.0_it_b77a5c561934e089\System.IdentityModel.Selectors.Resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\prnrc005.inf	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.ServiceProcess.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\AppPatch\AppPatch64	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\it\shfusion.chm	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\wizardAuthentication.ascx	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\1031\alinkui.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.OracleClient.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-PlatformUpdate-Win7-SRV08R2-Package-MiniLP~31bf3856ad364e35~amd64~nb-NO~7.1.7601.16492.cat	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\prnrc005.PNF	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Web.Mobile.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Windows Ringout.wav	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\WebAdminHelp_Application.aspx	AE 0124 BE.exe
File opened for modification	C:\Windows\PolicyDefinitions\ja-JP\EnhancedStorage.adml	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Workca489553#\336025d8c78c7f996af8ab8aac278688\System.Workflow.ComponentModel.ni.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\WindowsMediaPlayerMediaLibrary\ja-JP\DiagPackage.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dire573b08f5#\45c73b666d25924eb01d83df44e6003e	AE 0124 BE.exe
File opened for modification	C:\Windows\ehome\fr-FR\ehsched.exe.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Globalization.Extensions.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Drawing.resources\2.0.0.0_ja_b03f5f7f11d50a3a	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\LoadMxf\d09b54cd68bc772b3be3832926e940d4\LoadMxf.ni.exe	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\ehCIR\b648e07269decc9d5a2d8aeba1d48cbb	AE 0124 BE.exe
File opened for modification	C:\Windows\Cursors\lwe.cur	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\WindowsMediaPlayerMediaLibrary\DiagPackage.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\ehome\ehProxy.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\cordiab.ttf	AE 0124 BE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2044	DllHost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1380	e6b6edeaf9b53a6acae9b1814961b48a95e865d93d157738f5e248ad529225ce.exe
1212	winlogon.exe
1512	AE 0124 BE.exe
1340	winlogon.exe
1480	winlogon.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 1212	1380	e6b6edeaf9b53a6acae9b1814961b48a95e865d93d157738f5e248ad529225ce.exe	28
PID 1380 wrote to memory of 1212	1380	e6b6edeaf9b53a6acae9b1814961b48a95e865d93d157738f5e248ad529225ce.exe	28
PID 1380 wrote to memory of 1212	1380	e6b6edeaf9b53a6acae9b1814961b48a95e865d93d157738f5e248ad529225ce.exe	28
PID 1380 wrote to memory of 1212	1380	e6b6edeaf9b53a6acae9b1814961b48a95e865d93d157738f5e248ad529225ce.exe	28
PID 1212 wrote to memory of 1512	1212	winlogon.exe	29
PID 1212 wrote to memory of 1512	1212	winlogon.exe	29
PID 1212 wrote to memory of 1512	1212	winlogon.exe	29
PID 1212 wrote to memory of 1512	1212	winlogon.exe	29
PID 1212 wrote to memory of 1340	1212	winlogon.exe	30
PID 1212 wrote to memory of 1340	1212	winlogon.exe	30
PID 1212 wrote to memory of 1340	1212	winlogon.exe	30
PID 1212 wrote to memory of 1340	1212	winlogon.exe	30
PID 1512 wrote to memory of 1480	1512	AE 0124 BE.exe	31
PID 1512 wrote to memory of 1480	1512	AE 0124 BE.exe	31
PID 1512 wrote to memory of 1480	1512	AE 0124 BE.exe	31
PID 1512 wrote to memory of 1480	1512	AE 0124 BE.exe	31

C:\Users\Admin\AppData\Local\Temp\e6b6edeaf9b53a6acae9b1814961b48a95e865d93d157738f5e248ad529225ce.exe
"C:\Users\Admin\AppData\Local\Temp\e6b6edeaf9b53a6acae9b1814961b48a95e865d93d157738f5e248ad529225ce.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\SysWOW64\drivers\winlogon.exe
  "C:\Windows\System32\drivers\winlogon.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops autorun.inf file
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\AE 0124 BE.exe
    "C:\Windows\AE 0124 BE.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops desktop.ini file(s)
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1480
- - C:\Windows\SysWOW64\drivers\winlogon.exe
    "C:\Windows\System32\drivers\winlogon.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1340

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:2044

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AE 0124 BE.bmp

Filesize
132KB

MD5
2b31045b4342065348e7663fa5261fc0

SHA1
e0a6a39ce6e443ecd6f5f51b26c8ef23cc7effa9

SHA256
8f70ec54276cc4c13eaaa4ab3b2646ac9237278f2a16023456e0401e256eedfc

SHA512
530b8027da1aa270b3020d1f1dce90d89115bcdbb533fccc08f6536b69256bd8e3e2dd715434ffa9b1c55c8e02a2f81ed29d7529e92a727480fc6068c9b77ca2

Download Submit
C:\Windows\AE 0124 BE.bmp

Filesize
132KB

MD5
2b31045b4342065348e7663fa5261fc0

SHA1
e0a6a39ce6e443ecd6f5f51b26c8ef23cc7effa9

SHA256
8f70ec54276cc4c13eaaa4ab3b2646ac9237278f2a16023456e0401e256eedfc

SHA512
530b8027da1aa270b3020d1f1dce90d89115bcdbb533fccc08f6536b69256bd8e3e2dd715434ffa9b1c55c8e02a2f81ed29d7529e92a727480fc6068c9b77ca2

Download Submit
C:\Windows\AE 0124 BE.exe

Filesize
130KB

MD5
914316377f6bccff54b15012a90c4209

SHA1
0770bea820eaed31f29f08d58c24444b65afa03a

SHA256
81415202ca81494a7c47e355a5124532882071425c9bb94cc26274b79d489bc5

SHA512
eb24ea1b5a9e9c831d445f76de48b844596de3efc8971e5cb915bae12aa65a515accda3ae26975c2290fb1e2e2709862884893efbba2ed0d7ab2bbe51bf9d6e5

Download Submit
C:\Windows\AE 0124 BE.exe

Filesize
130KB

MD5
914316377f6bccff54b15012a90c4209

SHA1
0770bea820eaed31f29f08d58c24444b65afa03a

SHA256
81415202ca81494a7c47e355a5124532882071425c9bb94cc26274b79d489bc5

SHA512
eb24ea1b5a9e9c831d445f76de48b844596de3efc8971e5cb915bae12aa65a515accda3ae26975c2290fb1e2e2709862884893efbba2ed0d7ab2bbe51bf9d6e5

Download Submit
C:\Windows\Msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\drivers\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
914316377f6bccff54b15012a90c4209

SHA1
0770bea820eaed31f29f08d58c24444b65afa03a

SHA256
81415202ca81494a7c47e355a5124532882071425c9bb94cc26274b79d489bc5

SHA512
eb24ea1b5a9e9c831d445f76de48b844596de3efc8971e5cb915bae12aa65a515accda3ae26975c2290fb1e2e2709862884893efbba2ed0d7ab2bbe51bf9d6e5

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
914316377f6bccff54b15012a90c4209

SHA1
0770bea820eaed31f29f08d58c24444b65afa03a

SHA256
81415202ca81494a7c47e355a5124532882071425c9bb94cc26274b79d489bc5

SHA512
eb24ea1b5a9e9c831d445f76de48b844596de3efc8971e5cb915bae12aa65a515accda3ae26975c2290fb1e2e2709862884893efbba2ed0d7ab2bbe51bf9d6e5

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
914316377f6bccff54b15012a90c4209

SHA1
0770bea820eaed31f29f08d58c24444b65afa03a

SHA256
81415202ca81494a7c47e355a5124532882071425c9bb94cc26274b79d489bc5

SHA512
eb24ea1b5a9e9c831d445f76de48b844596de3efc8971e5cb915bae12aa65a515accda3ae26975c2290fb1e2e2709862884893efbba2ed0d7ab2bbe51bf9d6e5

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
914316377f6bccff54b15012a90c4209

SHA1
0770bea820eaed31f29f08d58c24444b65afa03a

SHA256
81415202ca81494a7c47e355a5124532882071425c9bb94cc26274b79d489bc5

SHA512
eb24ea1b5a9e9c831d445f76de48b844596de3efc8971e5cb915bae12aa65a515accda3ae26975c2290fb1e2e2709862884893efbba2ed0d7ab2bbe51bf9d6e5

Download Submit
\??\c:\B1uv3nth3x1.diz

Filesize
21B

MD5
9cceaa243c5d161e1ce41c7dad1903dd

SHA1
e3da72675df53fffa781d4377d1d62116eafb35b

SHA256
814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

SHA512
af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

Download Submit
\??\c:\B1uv3nth3x1.diz

Filesize
21B

MD5
9cceaa243c5d161e1ce41c7dad1903dd

SHA1
e3da72675df53fffa781d4377d1d62116eafb35b

SHA256
814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

SHA512
af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

Download Submit
\Windows\SysWOW64\drivers\Msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\drivers\Msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
914316377f6bccff54b15012a90c4209

SHA1
0770bea820eaed31f29f08d58c24444b65afa03a

SHA256
81415202ca81494a7c47e355a5124532882071425c9bb94cc26274b79d489bc5

SHA512
eb24ea1b5a9e9c831d445f76de48b844596de3efc8971e5cb915bae12aa65a515accda3ae26975c2290fb1e2e2709862884893efbba2ed0d7ab2bbe51bf9d6e5

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
914316377f6bccff54b15012a90c4209

SHA1
0770bea820eaed31f29f08d58c24444b65afa03a

SHA256
81415202ca81494a7c47e355a5124532882071425c9bb94cc26274b79d489bc5

SHA512
eb24ea1b5a9e9c831d445f76de48b844596de3efc8971e5cb915bae12aa65a515accda3ae26975c2290fb1e2e2709862884893efbba2ed0d7ab2bbe51bf9d6e5

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
914316377f6bccff54b15012a90c4209

SHA1
0770bea820eaed31f29f08d58c24444b65afa03a

SHA256
81415202ca81494a7c47e355a5124532882071425c9bb94cc26274b79d489bc5

SHA512
eb24ea1b5a9e9c831d445f76de48b844596de3efc8971e5cb915bae12aa65a515accda3ae26975c2290fb1e2e2709862884893efbba2ed0d7ab2bbe51bf9d6e5

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
914316377f6bccff54b15012a90c4209

SHA1
0770bea820eaed31f29f08d58c24444b65afa03a

SHA256
81415202ca81494a7c47e355a5124532882071425c9bb94cc26274b79d489bc5

SHA512
eb24ea1b5a9e9c831d445f76de48b844596de3efc8971e5cb915bae12aa65a515accda3ae26975c2290fb1e2e2709862884893efbba2ed0d7ab2bbe51bf9d6e5

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
914316377f6bccff54b15012a90c4209

SHA1
0770bea820eaed31f29f08d58c24444b65afa03a

SHA256
81415202ca81494a7c47e355a5124532882071425c9bb94cc26274b79d489bc5

SHA512
eb24ea1b5a9e9c831d445f76de48b844596de3efc8971e5cb915bae12aa65a515accda3ae26975c2290fb1e2e2709862884893efbba2ed0d7ab2bbe51bf9d6e5

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
914316377f6bccff54b15012a90c4209

SHA1
0770bea820eaed31f29f08d58c24444b65afa03a

SHA256
81415202ca81494a7c47e355a5124532882071425c9bb94cc26274b79d489bc5

SHA512
eb24ea1b5a9e9c831d445f76de48b844596de3efc8971e5cb915bae12aa65a515accda3ae26975c2290fb1e2e2709862884893efbba2ed0d7ab2bbe51bf9d6e5

Download Submit
memory/1380-56-0x0000000075021000-0x0000000075023000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads