njrat | 3c386a66e5f1d1b341a1466abdfd137fc23b39956009a5eb149386634b0515d1

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/10/2022, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
3C386A66E5F1D1B341A1466ABDFD137FC23B39956009A.exe
Size 5.0MB
Sample221007-znppkadee9
SHA256 3c386a66e5f1d1b341a1466abdfd137fc23b39956009a5eb149386634b0515d1
MD5 e3909de6ca1d545d7c45dff1d9a09fe4
SHA1 1624adb1b664a82b1e2605227e017d339d6f52e9
SHA512 af1b420ba7688823b0b9624751862f5d822b1a7da41b4c39d2db066aefc0d74796f172f817738d70b0b5332dc27ea13e8677a44f9fd563ff088081f0ceaac04f
SSDEEP 49152:WaFPC7nRODEYCFEvlmOmTgtFM3uK5m3imrHuiff+puWV355FXw/+zuWV355FXw/C:FYR8EYzEFTgtFM3ukm3imPntpRrR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat caly evasion persistence trojan upx

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

caly

reserva01.duckdns.org:1182

Mutex

0774bfb60a53c36c2bdece08db35ff3f

Attributes

reg_key
0774bfb60a53c36c2bdece08db35ff3f
splitter
|'|'|

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 10 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies security service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4"	reg.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Executes dropped EXE 12 IoCs

pid	Process
1584	LocalRtxdt_rOdN.exe
1660	LocalnKCHAEbIGf.exe
1512	LocalM_HSlyAaIP.exe
1836	LocalykPEWLOXjL.exe
1784	kms driver.exe
756	kms tap driver.exe
1520	svchost32.exe
1072	windows loader.exe
1120	java.exe
1276	Microsoft Windows.exe
756	tmp124A.tmp.exe
1304	Microsoft Office356.exe

Modifies Windows Firewall 1 TTPs 3 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1972	netsh.exe
1516	netsh.exe
1052	netsh.exe

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000139db-81.dat	upx
behavioral1/files/0x00070000000139db-83.dat	upx
behavioral1/files/0x00070000000139db-82.dat	upx
behavioral1/files/0x00070000000139db-85.dat	upx
behavioral1/memory/756-95-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/files/0x0006000000014142-102.dat	upx
behavioral1/files/0x0006000000014142-101.dat	upx
behavioral1/files/0x0006000000014142-100.dat	upx
behavioral1/files/0x0006000000014142-99.dat	upx
behavioral1/files/0x0006000000014142-106.dat	upx
behavioral1/files/0x0006000000014142-112.dat	upx
behavioral1/memory/1072-121-0x0000000000400000-0x0000000000623000-memory.dmp	upx
behavioral1/memory/756-147-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\05f68b2b547fc4eeb997b77c603c25f3.exe	Microsoft Office356.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\05f68b2b547fc4eeb997b77c603c25f3.exe	Microsoft Office356.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0774bfb60a53c36c2bdece08db35ff3f.exe	java.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0774bfb60a53c36c2bdece08db35ff3f.exe	java.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1220f3d22fa6a15bff15dd6ca45a06ee.exe	Microsoft Windows.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1220f3d22fa6a15bff15dd6ca45a06ee.exe	Microsoft Windows.exe

Loads dropped DLL 23 IoCs

pid	Process
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1836	LocalykPEWLOXjL.exe
1512	LocalM_HSlyAaIP.exe
1584	LocalRtxdt_rOdN.exe
1584	LocalRtxdt_rOdN.exe
1120	java.exe
1120	java.exe
756	tmp124A.tmp.exe
756	tmp124A.tmp.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\svchost32.exe = "C:\\Users\\Admin\\svchost32.exe"	svchost32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\0774bfb60a53c36c2bdece08db35ff3f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\java.exe\" .."	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\0774bfb60a53c36c2bdece08db35ff3f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\java.exe\" .."	java.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\1220f3d22fa6a15bff15dd6ca45a06ee = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Windows.exe\" .."	Microsoft Windows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1220f3d22fa6a15bff15dd6ca45a06ee = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft Windows.exe\" .."	Microsoft Windows.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\05f68b2b547fc4eeb997b77c603c25f3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft Office356.exe\" .."	Microsoft Office356.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\05f68b2b547fc4eeb997b77c603c25f3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft Office356.exe\" .."	Microsoft Office356.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	svchost32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
564	1784	WerFault.exe	32

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1520	svchost32.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeDebugPrivilege	1120	java.exe
Token: SeDebugPrivilege	1276	Microsoft Windows.exe
Token: 33	1120	java.exe
Token: SeIncBasePriorityPrivilege	1120	java.exe
Token: 33	1276	Microsoft Windows.exe
Token: SeIncBasePriorityPrivilege	1276	Microsoft Windows.exe
Token: 33	1120	java.exe
Token: SeIncBasePriorityPrivilege	1120	java.exe
Token: 33	1276	Microsoft Windows.exe
Token: SeIncBasePriorityPrivilege	1276	Microsoft Windows.exe
Token: 33	1120	java.exe
Token: SeIncBasePriorityPrivilege	1120	java.exe
Token: 33	1276	Microsoft Windows.exe
Token: SeIncBasePriorityPrivilege	1276	Microsoft Windows.exe
Token: 33	1120	java.exe
Token: SeIncBasePriorityPrivilege	1120	java.exe
Token: 33	1276	Microsoft Windows.exe
Token: SeIncBasePriorityPrivilege	1276	Microsoft Windows.exe
Token: 33	1120	java.exe
Token: SeIncBasePriorityPrivilege	1120	java.exe
Token: 33	1276	Microsoft Windows.exe
Token: SeIncBasePriorityPrivilege	1276	Microsoft Windows.exe
Token: SeDebugPrivilege	1304	Microsoft Office356.exe
Token: 33	1120	java.exe
Token: SeIncBasePriorityPrivilege	1120	java.exe
Token: 33	1276	Microsoft Windows.exe
Token: SeIncBasePriorityPrivilege	1276	Microsoft Windows.exe
Token: 33	1304	Microsoft Office356.exe
Token: SeIncBasePriorityPrivilege	1304	Microsoft Office356.exe
Token: 33	1120	java.exe
Token: SeIncBasePriorityPrivilege	1120	java.exe
Token: 33	1276	Microsoft Windows.exe
Token: SeIncBasePriorityPrivilege	1276	Microsoft Windows.exe
Token: 33	1304	Microsoft Office356.exe
Token: SeIncBasePriorityPrivilege	1304	Microsoft Office356.exe
Token: 33	1120	java.exe
Token: SeIncBasePriorityPrivilege	1120	java.exe
Token: 33	1276	Microsoft Windows.exe
Token: SeIncBasePriorityPrivilege	1276	Microsoft Windows.exe
Token: 33	1304	Microsoft Office356.exe
Token: SeIncBasePriorityPrivilege	1304	Microsoft Office356.exe
Token: 33	1120	java.exe
Token: SeIncBasePriorityPrivilege	1120	java.exe
Token: 33	1276	Microsoft Windows.exe
Token: SeIncBasePriorityPrivilege	1276	Microsoft Windows.exe
Token: 33	1304	Microsoft Office356.exe
Token: SeIncBasePriorityPrivilege	1304	Microsoft Office356.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1584	2032	3C386A66E5F1D1B341A1466ABDFD137FC23B39956009A.exe	28
PID 2032 wrote to memory of 1584	2032	3C386A66E5F1D1B341A1466ABDFD137FC23B39956009A.exe	28
PID 2032 wrote to memory of 1584	2032	3C386A66E5F1D1B341A1466ABDFD137FC23B39956009A.exe	28
PID 2032 wrote to memory of 1584	2032	3C386A66E5F1D1B341A1466ABDFD137FC23B39956009A.exe	28
PID 2032 wrote to memory of 1660	2032	3C386A66E5F1D1B341A1466ABDFD137FC23B39956009A.exe	29
PID 2032 wrote to memory of 1660	2032	3C386A66E5F1D1B341A1466ABDFD137FC23B39956009A.exe	29
PID 2032 wrote to memory of 1660	2032	3C386A66E5F1D1B341A1466ABDFD137FC23B39956009A.exe	29
PID 1660 wrote to memory of 1512	1660	LocalnKCHAEbIGf.exe	30
PID 1660 wrote to memory of 1512	1660	LocalnKCHAEbIGf.exe	30
PID 1660 wrote to memory of 1512	1660	LocalnKCHAEbIGf.exe	30
PID 1660 wrote to memory of 1512	1660	LocalnKCHAEbIGf.exe	30
PID 1660 wrote to memory of 1836	1660	LocalnKCHAEbIGf.exe	31
PID 1660 wrote to memory of 1836	1660	LocalnKCHAEbIGf.exe	31
PID 1660 wrote to memory of 1836	1660	LocalnKCHAEbIGf.exe	31
PID 1660 wrote to memory of 1836	1660	LocalnKCHAEbIGf.exe	31
PID 1836 wrote to memory of 1784	1836	LocalykPEWLOXjL.exe	32
PID 1836 wrote to memory of 1784	1836	LocalykPEWLOXjL.exe	32
PID 1836 wrote to memory of 1784	1836	LocalykPEWLOXjL.exe	32
PID 1836 wrote to memory of 1784	1836	LocalykPEWLOXjL.exe	32
PID 1836 wrote to memory of 756	1836	LocalykPEWLOXjL.exe	34
PID 1836 wrote to memory of 756	1836	LocalykPEWLOXjL.exe	34
PID 1836 wrote to memory of 756	1836	LocalykPEWLOXjL.exe	34
PID 1836 wrote to memory of 756	1836	LocalykPEWLOXjL.exe	34
PID 1836 wrote to memory of 1520	1836	LocalykPEWLOXjL.exe	35
PID 1836 wrote to memory of 1520	1836	LocalykPEWLOXjL.exe	35
PID 1836 wrote to memory of 1520	1836	LocalykPEWLOXjL.exe	35
PID 1836 wrote to memory of 1520	1836	LocalykPEWLOXjL.exe	35
PID 756 wrote to memory of 1288	756	kms tap driver.exe	36
PID 756 wrote to memory of 1288	756	kms tap driver.exe	36
PID 756 wrote to memory of 1288	756	kms tap driver.exe	36
PID 756 wrote to memory of 1288	756	kms tap driver.exe	36
PID 1288 wrote to memory of 280	1288	cmd.exe	38
PID 1288 wrote to memory of 280	1288	cmd.exe	38
PID 1288 wrote to memory of 280	1288	cmd.exe	38
PID 1836 wrote to memory of 1072	1836	LocalykPEWLOXjL.exe	39
PID 1836 wrote to memory of 1072	1836	LocalykPEWLOXjL.exe	39
PID 1836 wrote to memory of 1072	1836	LocalykPEWLOXjL.exe	39
PID 1836 wrote to memory of 1072	1836	LocalykPEWLOXjL.exe	39
PID 1288 wrote to memory of 1568	1288	cmd.exe	40
PID 1288 wrote to memory of 1568	1288	cmd.exe	40
PID 1288 wrote to memory of 1568	1288	cmd.exe	40
PID 1288 wrote to memory of 1672	1288	cmd.exe	41
PID 1288 wrote to memory of 1672	1288	cmd.exe	41
PID 1288 wrote to memory of 1672	1288	cmd.exe	41
PID 1288 wrote to memory of 1952	1288	cmd.exe	42
PID 1288 wrote to memory of 1952	1288	cmd.exe	42
PID 1288 wrote to memory of 1952	1288	cmd.exe	42
PID 1288 wrote to memory of 268	1288	cmd.exe	43
PID 1288 wrote to memory of 268	1288	cmd.exe	43
PID 1288 wrote to memory of 268	1288	cmd.exe	43
PID 1288 wrote to memory of 1256	1288	cmd.exe	44
PID 1288 wrote to memory of 1256	1288	cmd.exe	44
PID 1288 wrote to memory of 1256	1288	cmd.exe	44
PID 1288 wrote to memory of 836	1288	cmd.exe	45
PID 1288 wrote to memory of 836	1288	cmd.exe	45
PID 1288 wrote to memory of 836	1288	cmd.exe	45
PID 1288 wrote to memory of 1848	1288	cmd.exe	46
PID 1288 wrote to memory of 1848	1288	cmd.exe	46
PID 1288 wrote to memory of 1848	1288	cmd.exe	46
PID 1288 wrote to memory of 1940	1288	cmd.exe	47
PID 1288 wrote to memory of 1940	1288	cmd.exe	47
PID 1288 wrote to memory of 1940	1288	cmd.exe	47
PID 1288 wrote to memory of 624	1288	cmd.exe	48
PID 1288 wrote to memory of 624	1288	cmd.exe	48

C:\Users\Admin\AppData\Local\Temp\3C386A66E5F1D1B341A1466ABDFD137FC23B39956009A.exe
"C:\Users\Admin\AppData\Local\Temp\3C386A66E5F1D1B341A1466ABDFD137FC23B39956009A.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\LocalRtxdt_rOdN.exe
  "C:\Users\Admin\AppData\LocalRtxdt_rOdN.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1584
- - C:\Users\Admin\AppData\Roaming\Microsoft Windows.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft Windows.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
  - - C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\Microsoft Windows.exe" "Microsoft Windows.exe" ENABLE
      4⤵
      Modifies Windows Firewall
      PID:1972
- C:\Users\Admin\AppData\LocalnKCHAEbIGf.exe
  "C:\Users\Admin\AppData\LocalnKCHAEbIGf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\AppData\LocalM_HSlyAaIP.exe
    "C:\Users\Admin\AppData\LocalM_HSlyAaIP.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\java.exe
      "C:\Users\Admin\AppData\Local\Temp\java.exe"
      4⤵
      Executes dropped EXE
      Drops startup file
      Loads dropped DLL
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      PID:1120
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\java.exe" "java.exe" ENABLE
        5⤵
        Modifies Windows Firewall
        
        PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\tmp124A.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\tmp124A.tmp.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\Microsoft Office356.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Microsoft Office356.exe"
        6⤵
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:1304
        
        C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Microsoft Office356.exe" "Microsoft Office356.exe" ENABLE
        7⤵
        Modifies Windows Firewall
        
        PID:1516
- - C:\Users\Admin\AppData\LocalykPEWLOXjL.exe
    "C:\Users\Admin\AppData\LocalykPEWLOXjL.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Users\Admin\kms driver.exe
      "C:\Users\Admin\kms driver.exe"
      4⤵
      Executes dropped EXE
      PID:1784
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1784 -s 536
        5⤵
        Program crash
        
        PID:564
  - - C:\Users\Admin\kms tap driver.exe
      "C:\Users\Admin\kms tap driver.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:756
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7CE.tmp\7CF.tmp\7D0.bat "C:\Users\Admin\kms tap driver.exe""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1288
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        6⤵
        
        PID:280
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        6⤵
        
        PID:1568
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
        6⤵
        
        PID:1672
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1952
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:268
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1256
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:836
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        6⤵
        Modifies Windows Defender Real-time Protection settings
        
        PID:1848
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
        6⤵
        
        PID:1940
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
        6⤵
        
        PID:624
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
        6⤵
        
        PID:2032
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
        6⤵
        
        PID:1628
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
        6⤵
        
        PID:1620
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
        6⤵
        
        PID:1708
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
        6⤵
        
        PID:1680
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
        6⤵
        
        PID:912
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
        6⤵
        
        PID:1612
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        6⤵
        
        PID:952
      - C:\Windows\system32\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
        6⤵
        
        PID:1660
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
        6⤵
        
        PID:748
      - C:\Windows\system32\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
        6⤵
        
        PID:2036
      - C:\Windows\system32\reg.exe
        
        reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
        6⤵
        
        PID:1632
      - C:\Windows\system32\reg.exe
        
        reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
        6⤵
        
        PID:1560
      - C:\Windows\system32\reg.exe
        
        reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
        6⤵
        
        PID:1804
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
        6⤵
        
        PID:768
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
        6⤵
        
        PID:932
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
        6⤵
        
        PID:1828
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
        6⤵
        
        PID:1736
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
        6⤵
        Modifies security service
        
        PID:1636
  - - C:\Users\Admin\svchost32.exe
      "C:\Users\Admin\svchost32.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Suspicious behavior: AddClipboardFormatListener
      PID:1520
  - - C:\Users\Admin\windows loader.exe
      "C:\Users\Admin\windows loader.exe"
      4⤵
      Executes dropped EXE
      PID:1072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LocalM_HSlyAaIP.exe

Path C:\Users\Admin\AppData\LocalM_HSlyAaIP.exe
Size 23KB
SHA256 cbfb31ab9f66f631ffc54abe2c46c44ca64456f3e15a3a44c4117ebd3d208a8d
MD5 05f86a267474228523ef5e9a5f05e00c
SHA1 c688bf926d13d9437f1b153d338d1071ef4f0da9
SHA512 a0d46efb08fa1e768df1145ea4fa4d0ce26ff7d1e64535cd4afd2db256a778d2f31152044ed62bbcc53d3615590b461641f2d8ca68d209ec13feed47baa019bc
SSDEEP 384:4cqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZ+W:H30py6vhxaRpcnuS
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalM_HSlyAaIP.exe

Path C:\Users\Admin\AppData\LocalM_HSlyAaIP.exe
Size 23KB
SHA256 cbfb31ab9f66f631ffc54abe2c46c44ca64456f3e15a3a44c4117ebd3d208a8d
MD5 05f86a267474228523ef5e9a5f05e00c
SHA1 c688bf926d13d9437f1b153d338d1071ef4f0da9
SHA512 a0d46efb08fa1e768df1145ea4fa4d0ce26ff7d1e64535cd4afd2db256a778d2f31152044ed62bbcc53d3615590b461641f2d8ca68d209ec13feed47baa019bc
SSDEEP 384:4cqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZ+W:H30py6vhxaRpcnuS
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalRtxdt_rOdN.exe

Path C:\Users\Admin\AppData\LocalRtxdt_rOdN.exe
Size 103KB
SHA256 2cb7fde4dbd246947237719517b558afd64bad4d4a1ff51bf9fbda68c846f078
MD5 d40fb256da2f4530ef3c9029f68b156d
SHA1 6f313d04b2339cfd7dbd1b87639539cf21f632d3
SHA512 58723ebebb1cf2ff5f93b5391b8cd662b7167927b32dd775c86da2f783dcf71a9bd470459574be81e866bb6f20dace10d72f3b818bf9061e944d9feec1e49f11
SSDEEP 3072:RRsgSrth8mNMJNhYF8oNSacX/w9ofhvB9kEvgkao:LjKt+mNMJwqMfcvDvB91tL
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalRtxdt_rOdN.exe

Path C:\Users\Admin\AppData\LocalRtxdt_rOdN.exe
Size 103KB
SHA256 2cb7fde4dbd246947237719517b558afd64bad4d4a1ff51bf9fbda68c846f078
MD5 d40fb256da2f4530ef3c9029f68b156d
SHA1 6f313d04b2339cfd7dbd1b87639539cf21f632d3
SHA512 58723ebebb1cf2ff5f93b5391b8cd662b7167927b32dd775c86da2f783dcf71a9bd470459574be81e866bb6f20dace10d72f3b818bf9061e944d9feec1e49f11
SSDEEP 3072:RRsgSrth8mNMJNhYF8oNSacX/w9ofhvB9kEvgkao:LjKt+mNMJwqMfcvDvB91tL
MD5 SHA1 SHA512 SSDEEP

Submit Download

7D0.bat

Path C:\Users\Admin\AppData\Local\Temp\7CE.tmp\7CF.tmp\7D0.bat
Size 3KB
SHA256 f6498b247cc03e1599bb19fc49dabb923b675bdfb0fd2348f78861842624f809
MD5 3a981c51aac5475414f6dea9f4e6ae1a
SHA1 90fb6d188c3a6a04f9294fabc71f62635f0c3ea6
SHA512 a8b49ee8606681f5559d3edddf1708df86f33b9029f140030037d4d2dff40bd288e0c69096be0ead4da4019c0ca5efcf81a33c7405bc82040fe833bb473f0e0b
MD5 SHA1 SHA512

Submit Download

Microsoft Office356.exe

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Office356.exe
Size 97KB
SHA256 99273154c07a76b475ef1cfa816f021631baafdd93f3290971313b8484198028
MD5 28f8125636448a929d1a18a8ddb8788b
SHA1 826e71c7570b0a9fcd11437c8fb8a94dee424f6b
SHA512 4ddfbd61f3d79bfa4a0da7993aa09fae71f25145ebb3e8492d6cfa105860596d30457f5bff703a891e67c0ec7d671eb6f2ae50e10307e2f0d633a7ff1a906cab
SSDEEP 3072:TyRuWh052TJqW/eojf7P0gE6vZiA+O3Jd:+R3hWUqWGof8hG+O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Office356.exe

Path C:\Users\Admin\AppData\Local\Temp\Microsoft Office356.exe
Size 97KB
SHA256 99273154c07a76b475ef1cfa816f021631baafdd93f3290971313b8484198028
MD5 28f8125636448a929d1a18a8ddb8788b
SHA1 826e71c7570b0a9fcd11437c8fb8a94dee424f6b
SHA512 4ddfbd61f3d79bfa4a0da7993aa09fae71f25145ebb3e8492d6cfa105860596d30457f5bff703a891e67c0ec7d671eb6f2ae50e10307e2f0d633a7ff1a906cab
SSDEEP 3072:TyRuWh052TJqW/eojf7P0gE6vZiA+O3Jd:+R3hWUqWGof8hG+O
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Users\Admin\AppData\Local\Temp\java.exe
Size 23KB
SHA256 cbfb31ab9f66f631ffc54abe2c46c44ca64456f3e15a3a44c4117ebd3d208a8d
MD5 05f86a267474228523ef5e9a5f05e00c
SHA1 c688bf926d13d9437f1b153d338d1071ef4f0da9
SHA512 a0d46efb08fa1e768df1145ea4fa4d0ce26ff7d1e64535cd4afd2db256a778d2f31152044ed62bbcc53d3615590b461641f2d8ca68d209ec13feed47baa019bc
SSDEEP 384:4cqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZ+W:H30py6vhxaRpcnuS
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path C:\Users\Admin\AppData\Local\Temp\java.exe
Size 23KB
SHA256 cbfb31ab9f66f631ffc54abe2c46c44ca64456f3e15a3a44c4117ebd3d208a8d
MD5 05f86a267474228523ef5e9a5f05e00c
SHA1 c688bf926d13d9437f1b153d338d1071ef4f0da9
SHA512 a0d46efb08fa1e768df1145ea4fa4d0ce26ff7d1e64535cd4afd2db256a778d2f31152044ed62bbcc53d3615590b461641f2d8ca68d209ec13feed47baa019bc
SSDEEP 384:4cqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZ+W:H30py6vhxaRpcnuS
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp124A.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp124A.tmp.exe
Size 97KB
SHA256 99273154c07a76b475ef1cfa816f021631baafdd93f3290971313b8484198028
MD5 28f8125636448a929d1a18a8ddb8788b
SHA1 826e71c7570b0a9fcd11437c8fb8a94dee424f6b
SHA512 4ddfbd61f3d79bfa4a0da7993aa09fae71f25145ebb3e8492d6cfa105860596d30457f5bff703a891e67c0ec7d671eb6f2ae50e10307e2f0d633a7ff1a906cab
SSDEEP 3072:TyRuWh052TJqW/eojf7P0gE6vZiA+O3Jd:+R3hWUqWGof8hG+O
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp124A.tmp.exe

Path C:\Users\Admin\AppData\Local\Temp\tmp124A.tmp.exe
Size 97KB
SHA256 99273154c07a76b475ef1cfa816f021631baafdd93f3290971313b8484198028
MD5 28f8125636448a929d1a18a8ddb8788b
SHA1 826e71c7570b0a9fcd11437c8fb8a94dee424f6b
SHA512 4ddfbd61f3d79bfa4a0da7993aa09fae71f25145ebb3e8492d6cfa105860596d30457f5bff703a891e67c0ec7d671eb6f2ae50e10307e2f0d633a7ff1a906cab
SSDEEP 3072:TyRuWh052TJqW/eojf7P0gE6vZiA+O3Jd:+R3hWUqWGof8hG+O
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalnKCHAEbIGf.exe

Path C:\Users\Admin\AppData\LocalnKCHAEbIGf.exe
Size 4.7MB
SHA256 10c2a021297d062ff69ea90add02c2195adaaddb2519dac6ff64be6c3161f11d
MD5 7611fd504f29ebb8fd0afb5765ec1a55
SHA1 1b76571c5e29ffa0c4e8496bab879912fce0c803
SHA512 8d56148e4a03778d0fe9d2bf7865855a044533aea0c8d058fbce6da60b3d963d631a33691bcd9b45a9dacc2785d67398ad9b031fb3d4a63f92555652a9bdadd0
SSDEEP 49152:naFPC7nRODEYCFEvlmOmTgtFM3uK5m3imrHuiff+puWV355FXw/+zuWV355FXw/M:qYR8EYzEFTgtFM3ukm3imPntpR
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalnKCHAEbIGf.exe

Path C:\Users\Admin\AppData\LocalnKCHAEbIGf.exe
Size 4.7MB
SHA256 10c2a021297d062ff69ea90add02c2195adaaddb2519dac6ff64be6c3161f11d
MD5 7611fd504f29ebb8fd0afb5765ec1a55
SHA1 1b76571c5e29ffa0c4e8496bab879912fce0c803
SHA512 8d56148e4a03778d0fe9d2bf7865855a044533aea0c8d058fbce6da60b3d963d631a33691bcd9b45a9dacc2785d67398ad9b031fb3d4a63f92555652a9bdadd0
SSDEEP 49152:naFPC7nRODEYCFEvlmOmTgtFM3uK5m3imrHuiff+puWV355FXw/+zuWV355FXw/M:qYR8EYzEFTgtFM3ukm3imPntpR
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalykPEWLOXjL.exe

Path C:\Users\Admin\AppData\LocalykPEWLOXjL.exe
Size 4.6MB
SHA256 0ef44d8f2aba4eaabaf2095ac409999a73566c6e45bc02797c4b217d53a57de8
MD5 7e226516080698c8b4d203c23e3f36a1
SHA1 1d65951e8d3054d1b2ed0ba115d747e160aa55f6
SHA512 d74033267b4cb984c591e76f1d35902bcfd8a327edf41fd942b26e23e277de0710d79d5450e5238ad72774847e75514ec6cab3fe8ad0b3305af95fb81addc51c
SSDEEP 49152:MaFPC7nRODEYCFEvlmOmTgtFM3uK5m3imrHuiff+puWV355FXw/+zuWV355FXw/m:LYR8EYzEFTgtFM3ukm3imPnt6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Windows.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft Windows.exe
Size 103KB
SHA256 2cb7fde4dbd246947237719517b558afd64bad4d4a1ff51bf9fbda68c846f078
MD5 d40fb256da2f4530ef3c9029f68b156d
SHA1 6f313d04b2339cfd7dbd1b87639539cf21f632d3
SHA512 58723ebebb1cf2ff5f93b5391b8cd662b7167927b32dd775c86da2f783dcf71a9bd470459574be81e866bb6f20dace10d72f3b818bf9061e944d9feec1e49f11
SSDEEP 3072:RRsgSrth8mNMJNhYF8oNSacX/w9ofhvB9kEvgkao:LjKt+mNMJwqMfcvDvB91tL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Windows.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft Windows.exe
Size 103KB
SHA256 2cb7fde4dbd246947237719517b558afd64bad4d4a1ff51bf9fbda68c846f078
MD5 d40fb256da2f4530ef3c9029f68b156d
SHA1 6f313d04b2339cfd7dbd1b87639539cf21f632d3
SHA512 58723ebebb1cf2ff5f93b5391b8cd662b7167927b32dd775c86da2f783dcf71a9bd470459574be81e866bb6f20dace10d72f3b818bf9061e944d9feec1e49f11
SSDEEP 3072:RRsgSrth8mNMJNhYF8oNSacX/w9ofhvB9kEvgkao:LjKt+mNMJwqMfcvDvB91tL
MD5 SHA1 SHA512 SSDEEP

Submit Download

kms driver.exe

Path C:\Users\Admin\kms driver.exe
Size 46KB
SHA256 1b18c8baa20838d3115f8d640f57c2d2e9e95d09780ace2067539574215a6d17
MD5 5f3f77593b1a5bc4e96257a38a8666b1
SHA1 532c981cd1a07ca62c97e9bc5f66fb4def4b2cc0
SHA512 59b1ac76f5a9a30680da37fc0d4d6aed370fdef189766c64697bfca1ba422a4a6517b94ad1de524e4af83b68f0eb3e9a209315c47b486f22c1849ffd8ec23200
SSDEEP 768:NE39wO4jYYl0J6tM41v17bMDyyx5NHOu0boLj1fnvgm3HytuZ9yxLVNe9z6/:NE39jYYYlc8nmyOJX3StuZUnNaz6/
MD5 SHA1 SHA512 SSDEEP

Submit Download

kms driver.exe

Path C:\Users\Admin\kms driver.exe
Size 46KB
SHA256 1b18c8baa20838d3115f8d640f57c2d2e9e95d09780ace2067539574215a6d17
MD5 5f3f77593b1a5bc4e96257a38a8666b1
SHA1 532c981cd1a07ca62c97e9bc5f66fb4def4b2cc0
SHA512 59b1ac76f5a9a30680da37fc0d4d6aed370fdef189766c64697bfca1ba422a4a6517b94ad1de524e4af83b68f0eb3e9a209315c47b486f22c1849ffd8ec23200
SSDEEP 768:NE39wO4jYYl0J6tM41v17bMDyyx5NHOu0boLj1fnvgm3HytuZ9yxLVNe9z6/:NE39jYYYlc8nmyOJX3StuZUnNaz6/
MD5 SHA1 SHA512 SSDEEP

Submit Download

kms tap driver.exe

Path C:\Users\Admin\kms tap driver.exe
Size 59KB
SHA256 4318860735858dab331f918367caf179c21dcae917df8119609d2edf58eaa5f9
MD5 e0b6a8a56069214d6dc31a2c053f73f7
SHA1 3eb13ab2e49014437c904f8ada2d22a85fd503e4
SHA512 080409c159559060b898978b36378c848f882e6c033bb0fb8307478ebd346b418aea653627f456f523fd57626b0ce0b26e0fe323541a790c1fc96a33b9e2ed68
SSDEEP 1536:qpfEKNCj6VoJl9Go5K7s4Nu3BLrdnouy8WpuZUnNaz6/:qVZ/VGS7rN+7outW8UNaG/
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost32.exe

Path C:\Users\Admin\svchost32.exe
Size 516KB
SHA256 59389be9fafbd6a39149303290f13e8a53c3f2276b9d8f2b1d7838054444ad2b
MD5 d3c2cb9d9114044df0cf663264e391a5
SHA1 812b8b1eadcafd911e557dccf1cf02fcd8cf63b0
SHA512 faa21426883beab53a7d7d36cd6af2ad6ceb2b4feaff61a94a3f947b1c93c201009f3ca7571fd6fc0a24a328510edeb1acefb87ba6d3086bb6600cdc3552b933
SSDEEP 12288:QD6976FrBXfJ4t27bGP7T7RweO8sLHiMjG:e46F5KybM7nR/OTiMjG
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows loader.exe

Path C:\Users\Admin\windows loader.exe
Size 3.8MB
SHA256 2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94
MD5 323c0fd51071400b51eedb1be90a8188
SHA1 0efc35935957c25193bbe9a83ab6caa25a487ada
SHA512 4c501c7135962e2f02b68d6069f2191ddb76f990528dacd209955a44972122718b9598400ba829abab2d4345b4e1a4b93453c8e7ba42080bd492a34cf8443e7e
SSDEEP 49152:cEYCFEvlmOmTgtFM3uK5m3imrHuiff+puWV355FXw/+zuWV355FXw/+DuWV355FP:cEYzEFTgtFM3ukm3imPnt
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows loader.exe

Path C:\Users\Admin\windows loader.exe
Size 3.8MB
SHA256 2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94
MD5 323c0fd51071400b51eedb1be90a8188
SHA1 0efc35935957c25193bbe9a83ab6caa25a487ada
SHA512 4c501c7135962e2f02b68d6069f2191ddb76f990528dacd209955a44972122718b9598400ba829abab2d4345b4e1a4b93453c8e7ba42080bd492a34cf8443e7e
SSDEEP 49152:cEYCFEvlmOmTgtFM3uK5m3imrHuiff+puWV355FXw/+zuWV355FXw/+DuWV355FP:cEYzEFTgtFM3ukm3imPnt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Office356.exe

Path \Users\Admin\AppData\Local\Temp\Microsoft Office356.exe
Size 97KB
SHA256 99273154c07a76b475ef1cfa816f021631baafdd93f3290971313b8484198028
MD5 28f8125636448a929d1a18a8ddb8788b
SHA1 826e71c7570b0a9fcd11437c8fb8a94dee424f6b
SHA512 4ddfbd61f3d79bfa4a0da7993aa09fae71f25145ebb3e8492d6cfa105860596d30457f5bff703a891e67c0ec7d671eb6f2ae50e10307e2f0d633a7ff1a906cab
SSDEEP 3072:TyRuWh052TJqW/eojf7P0gE6vZiA+O3Jd:+R3hWUqWGof8hG+O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Office356.exe

Path \Users\Admin\AppData\Local\Temp\Microsoft Office356.exe
Size 97KB
SHA256 99273154c07a76b475ef1cfa816f021631baafdd93f3290971313b8484198028
MD5 28f8125636448a929d1a18a8ddb8788b
SHA1 826e71c7570b0a9fcd11437c8fb8a94dee424f6b
SHA512 4ddfbd61f3d79bfa4a0da7993aa09fae71f25145ebb3e8492d6cfa105860596d30457f5bff703a891e67c0ec7d671eb6f2ae50e10307e2f0d633a7ff1a906cab
SSDEEP 3072:TyRuWh052TJqW/eojf7P0gE6vZiA+O3Jd:+R3hWUqWGof8hG+O
MD5 SHA1 SHA512 SSDEEP

Submit Download

java.exe

Path \Users\Admin\AppData\Local\Temp\java.exe
Size 23KB
SHA256 cbfb31ab9f66f631ffc54abe2c46c44ca64456f3e15a3a44c4117ebd3d208a8d
MD5 05f86a267474228523ef5e9a5f05e00c
SHA1 c688bf926d13d9437f1b153d338d1071ef4f0da9
SHA512 a0d46efb08fa1e768df1145ea4fa4d0ce26ff7d1e64535cd4afd2db256a778d2f31152044ed62bbcc53d3615590b461641f2d8ca68d209ec13feed47baa019bc
SSDEEP 384:4cqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZ+W:H30py6vhxaRpcnuS
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp124A.tmp.exe

Path \Users\Admin\AppData\Local\Temp\tmp124A.tmp.exe
Size 97KB
SHA256 99273154c07a76b475ef1cfa816f021631baafdd93f3290971313b8484198028
MD5 28f8125636448a929d1a18a8ddb8788b
SHA1 826e71c7570b0a9fcd11437c8fb8a94dee424f6b
SHA512 4ddfbd61f3d79bfa4a0da7993aa09fae71f25145ebb3e8492d6cfa105860596d30457f5bff703a891e67c0ec7d671eb6f2ae50e10307e2f0d633a7ff1a906cab
SSDEEP 3072:TyRuWh052TJqW/eojf7P0gE6vZiA+O3Jd:+R3hWUqWGof8hG+O
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmp124A.tmp.exe

Path \Users\Admin\AppData\Local\Temp\tmp124A.tmp.exe
Size 97KB
SHA256 99273154c07a76b475ef1cfa816f021631baafdd93f3290971313b8484198028
MD5 28f8125636448a929d1a18a8ddb8788b
SHA1 826e71c7570b0a9fcd11437c8fb8a94dee424f6b
SHA512 4ddfbd61f3d79bfa4a0da7993aa09fae71f25145ebb3e8492d6cfa105860596d30457f5bff703a891e67c0ec7d671eb6f2ae50e10307e2f0d633a7ff1a906cab
SSDEEP 3072:TyRuWh052TJqW/eojf7P0gE6vZiA+O3Jd:+R3hWUqWGof8hG+O
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Windows.exe

Path \Users\Admin\AppData\Roaming\Microsoft Windows.exe
Size 103KB
SHA256 2cb7fde4dbd246947237719517b558afd64bad4d4a1ff51bf9fbda68c846f078
MD5 d40fb256da2f4530ef3c9029f68b156d
SHA1 6f313d04b2339cfd7dbd1b87639539cf21f632d3
SHA512 58723ebebb1cf2ff5f93b5391b8cd662b7167927b32dd775c86da2f783dcf71a9bd470459574be81e866bb6f20dace10d72f3b818bf9061e944d9feec1e49f11
SSDEEP 3072:RRsgSrth8mNMJNhYF8oNSacX/w9ofhvB9kEvgkao:LjKt+mNMJwqMfcvDvB91tL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Windows.exe

Path \Users\Admin\AppData\Roaming\Microsoft Windows.exe
Size 103KB
SHA256 2cb7fde4dbd246947237719517b558afd64bad4d4a1ff51bf9fbda68c846f078
MD5 d40fb256da2f4530ef3c9029f68b156d
SHA1 6f313d04b2339cfd7dbd1b87639539cf21f632d3
SHA512 58723ebebb1cf2ff5f93b5391b8cd662b7167927b32dd775c86da2f783dcf71a9bd470459574be81e866bb6f20dace10d72f3b818bf9061e944d9feec1e49f11
SSDEEP 3072:RRsgSrth8mNMJNhYF8oNSacX/w9ofhvB9kEvgkao:LjKt+mNMJwqMfcvDvB91tL
MD5 SHA1 SHA512 SSDEEP

Submit Download

kms driver.exe

Path \Users\Admin\kms driver.exe
Size 46KB
SHA256 1b18c8baa20838d3115f8d640f57c2d2e9e95d09780ace2067539574215a6d17
MD5 5f3f77593b1a5bc4e96257a38a8666b1
SHA1 532c981cd1a07ca62c97e9bc5f66fb4def4b2cc0
SHA512 59b1ac76f5a9a30680da37fc0d4d6aed370fdef189766c64697bfca1ba422a4a6517b94ad1de524e4af83b68f0eb3e9a209315c47b486f22c1849ffd8ec23200
SSDEEP 768:NE39wO4jYYl0J6tM41v17bMDyyx5NHOu0boLj1fnvgm3HytuZ9yxLVNe9z6/:NE39jYYYlc8nmyOJX3StuZUnNaz6/
MD5 SHA1 SHA512 SSDEEP

Submit Download

kms driver.exe

Path \Users\Admin\kms driver.exe
Size 46KB
SHA256 1b18c8baa20838d3115f8d640f57c2d2e9e95d09780ace2067539574215a6d17
MD5 5f3f77593b1a5bc4e96257a38a8666b1
SHA1 532c981cd1a07ca62c97e9bc5f66fb4def4b2cc0
SHA512 59b1ac76f5a9a30680da37fc0d4d6aed370fdef189766c64697bfca1ba422a4a6517b94ad1de524e4af83b68f0eb3e9a209315c47b486f22c1849ffd8ec23200
SSDEEP 768:NE39wO4jYYl0J6tM41v17bMDyyx5NHOu0boLj1fnvgm3HytuZ9yxLVNe9z6/:NE39jYYYlc8nmyOJX3StuZUnNaz6/
MD5 SHA1 SHA512 SSDEEP

Submit Download

kms driver.exe

Path \Users\Admin\kms driver.exe
Size 46KB
SHA256 1b18c8baa20838d3115f8d640f57c2d2e9e95d09780ace2067539574215a6d17
MD5 5f3f77593b1a5bc4e96257a38a8666b1
SHA1 532c981cd1a07ca62c97e9bc5f66fb4def4b2cc0
SHA512 59b1ac76f5a9a30680da37fc0d4d6aed370fdef189766c64697bfca1ba422a4a6517b94ad1de524e4af83b68f0eb3e9a209315c47b486f22c1849ffd8ec23200
SSDEEP 768:NE39wO4jYYl0J6tM41v17bMDyyx5NHOu0boLj1fnvgm3HytuZ9yxLVNe9z6/:NE39jYYYlc8nmyOJX3StuZUnNaz6/
MD5 SHA1 SHA512 SSDEEP

Submit Download

kms driver.exe

Path \Users\Admin\kms driver.exe
Size 46KB
SHA256 1b18c8baa20838d3115f8d640f57c2d2e9e95d09780ace2067539574215a6d17
MD5 5f3f77593b1a5bc4e96257a38a8666b1
SHA1 532c981cd1a07ca62c97e9bc5f66fb4def4b2cc0
SHA512 59b1ac76f5a9a30680da37fc0d4d6aed370fdef189766c64697bfca1ba422a4a6517b94ad1de524e4af83b68f0eb3e9a209315c47b486f22c1849ffd8ec23200
SSDEEP 768:NE39wO4jYYl0J6tM41v17bMDyyx5NHOu0boLj1fnvgm3HytuZ9yxLVNe9z6/:NE39jYYYlc8nmyOJX3StuZUnNaz6/
MD5 SHA1 SHA512 SSDEEP

Submit Download

kms tap driver.exe

Path \Users\Admin\kms tap driver.exe
Size 59KB
SHA256 4318860735858dab331f918367caf179c21dcae917df8119609d2edf58eaa5f9
MD5 e0b6a8a56069214d6dc31a2c053f73f7
SHA1 3eb13ab2e49014437c904f8ada2d22a85fd503e4
SHA512 080409c159559060b898978b36378c848f882e6c033bb0fb8307478ebd346b418aea653627f456f523fd57626b0ce0b26e0fe323541a790c1fc96a33b9e2ed68
SSDEEP 1536:qpfEKNCj6VoJl9Go5K7s4Nu3BLrdnouy8WpuZUnNaz6/:qVZ/VGS7rN+7outW8UNaG/
MD5 SHA1 SHA512 SSDEEP

Submit Download

kms tap driver.exe

Path \Users\Admin\kms tap driver.exe
Size 59KB
SHA256 4318860735858dab331f918367caf179c21dcae917df8119609d2edf58eaa5f9
MD5 e0b6a8a56069214d6dc31a2c053f73f7
SHA1 3eb13ab2e49014437c904f8ada2d22a85fd503e4
SHA512 080409c159559060b898978b36378c848f882e6c033bb0fb8307478ebd346b418aea653627f456f523fd57626b0ce0b26e0fe323541a790c1fc96a33b9e2ed68
SSDEEP 1536:qpfEKNCj6VoJl9Go5K7s4Nu3BLrdnouy8WpuZUnNaz6/:qVZ/VGS7rN+7outW8UNaG/
MD5 SHA1 SHA512 SSDEEP

Submit Download

kms tap driver.exe

Path \Users\Admin\kms tap driver.exe
Size 59KB
SHA256 4318860735858dab331f918367caf179c21dcae917df8119609d2edf58eaa5f9
MD5 e0b6a8a56069214d6dc31a2c053f73f7
SHA1 3eb13ab2e49014437c904f8ada2d22a85fd503e4
SHA512 080409c159559060b898978b36378c848f882e6c033bb0fb8307478ebd346b418aea653627f456f523fd57626b0ce0b26e0fe323541a790c1fc96a33b9e2ed68
SSDEEP 1536:qpfEKNCj6VoJl9Go5K7s4Nu3BLrdnouy8WpuZUnNaz6/:qVZ/VGS7rN+7outW8UNaG/
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost32.exe

Path \Users\Admin\svchost32.exe
Size 516KB
SHA256 59389be9fafbd6a39149303290f13e8a53c3f2276b9d8f2b1d7838054444ad2b
MD5 d3c2cb9d9114044df0cf663264e391a5
SHA1 812b8b1eadcafd911e557dccf1cf02fcd8cf63b0
SHA512 faa21426883beab53a7d7d36cd6af2ad6ceb2b4feaff61a94a3f947b1c93c201009f3ca7571fd6fc0a24a328510edeb1acefb87ba6d3086bb6600cdc3552b933
SSDEEP 12288:QD6976FrBXfJ4t27bGP7T7RweO8sLHiMjG:e46F5KybM7nR/OTiMjG
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost32.exe

Path \Users\Admin\svchost32.exe
Size 516KB
SHA256 59389be9fafbd6a39149303290f13e8a53c3f2276b9d8f2b1d7838054444ad2b
MD5 d3c2cb9d9114044df0cf663264e391a5
SHA1 812b8b1eadcafd911e557dccf1cf02fcd8cf63b0
SHA512 faa21426883beab53a7d7d36cd6af2ad6ceb2b4feaff61a94a3f947b1c93c201009f3ca7571fd6fc0a24a328510edeb1acefb87ba6d3086bb6600cdc3552b933
SSDEEP 12288:QD6976FrBXfJ4t27bGP7T7RweO8sLHiMjG:e46F5KybM7nR/OTiMjG
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost32.exe

Path \Users\Admin\svchost32.exe
Size 516KB
SHA256 59389be9fafbd6a39149303290f13e8a53c3f2276b9d8f2b1d7838054444ad2b
MD5 d3c2cb9d9114044df0cf663264e391a5
SHA1 812b8b1eadcafd911e557dccf1cf02fcd8cf63b0
SHA512 faa21426883beab53a7d7d36cd6af2ad6ceb2b4feaff61a94a3f947b1c93c201009f3ca7571fd6fc0a24a328510edeb1acefb87ba6d3086bb6600cdc3552b933
SSDEEP 12288:QD6976FrBXfJ4t27bGP7T7RweO8sLHiMjG:e46F5KybM7nR/OTiMjG
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost32.exe

Path \Users\Admin\svchost32.exe
Size 516KB
SHA256 59389be9fafbd6a39149303290f13e8a53c3f2276b9d8f2b1d7838054444ad2b
MD5 d3c2cb9d9114044df0cf663264e391a5
SHA1 812b8b1eadcafd911e557dccf1cf02fcd8cf63b0
SHA512 faa21426883beab53a7d7d36cd6af2ad6ceb2b4feaff61a94a3f947b1c93c201009f3ca7571fd6fc0a24a328510edeb1acefb87ba6d3086bb6600cdc3552b933
SSDEEP 12288:QD6976FrBXfJ4t27bGP7T7RweO8sLHiMjG:e46F5KybM7nR/OTiMjG
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost32.exe

Path \Users\Admin\svchost32.exe
Size 516KB
SHA256 59389be9fafbd6a39149303290f13e8a53c3f2276b9d8f2b1d7838054444ad2b
MD5 d3c2cb9d9114044df0cf663264e391a5
SHA1 812b8b1eadcafd911e557dccf1cf02fcd8cf63b0
SHA512 faa21426883beab53a7d7d36cd6af2ad6ceb2b4feaff61a94a3f947b1c93c201009f3ca7571fd6fc0a24a328510edeb1acefb87ba6d3086bb6600cdc3552b933
SSDEEP 12288:QD6976FrBXfJ4t27bGP7T7RweO8sLHiMjG:e46F5KybM7nR/OTiMjG
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows loader.exe

Path \Users\Admin\windows loader.exe
Size 3.8MB
SHA256 2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94
MD5 323c0fd51071400b51eedb1be90a8188
SHA1 0efc35935957c25193bbe9a83ab6caa25a487ada
SHA512 4c501c7135962e2f02b68d6069f2191ddb76f990528dacd209955a44972122718b9598400ba829abab2d4345b4e1a4b93453c8e7ba42080bd492a34cf8443e7e
SSDEEP 49152:cEYCFEvlmOmTgtFM3uK5m3imrHuiff+puWV355FXw/+zuWV355FXw/+DuWV355FP:cEYzEFTgtFM3ukm3imPnt
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows loader.exe

Path \Users\Admin\windows loader.exe
Size 3.8MB
SHA256 2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94
MD5 323c0fd51071400b51eedb1be90a8188
SHA1 0efc35935957c25193bbe9a83ab6caa25a487ada
SHA512 4c501c7135962e2f02b68d6069f2191ddb76f990528dacd209955a44972122718b9598400ba829abab2d4345b4e1a4b93453c8e7ba42080bd492a34cf8443e7e
SSDEEP 49152:cEYCFEvlmOmTgtFM3uK5m3imrHuiff+puWV355FXw/+zuWV355FXw/+DuWV355FP:cEYzEFTgtFM3ukm3imPnt
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows loader.exe

Path \Users\Admin\windows loader.exe
Size 3.8MB
SHA256 2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94
MD5 323c0fd51071400b51eedb1be90a8188
SHA1 0efc35935957c25193bbe9a83ab6caa25a487ada
SHA512 4c501c7135962e2f02b68d6069f2191ddb76f990528dacd209955a44972122718b9598400ba829abab2d4345b4e1a4b93453c8e7ba42080bd492a34cf8443e7e
SSDEEP 49152:cEYCFEvlmOmTgtFM3uK5m3imrHuiff+puWV355FXw/+zuWV355FXw/+DuWV355FP:cEYzEFTgtFM3ukm3imPnt
MD5 SHA1 SHA512 SSDEEP

Submit Download

windows loader.exe

Path \Users\Admin\windows loader.exe
Size 3.8MB
SHA256 2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94
MD5 323c0fd51071400b51eedb1be90a8188
SHA1 0efc35935957c25193bbe9a83ab6caa25a487ada
SHA512 4c501c7135962e2f02b68d6069f2191ddb76f990528dacd209955a44972122718b9598400ba829abab2d4345b4e1a4b93453c8e7ba42080bd492a34cf8443e7e
SSDEEP 49152:cEYCFEvlmOmTgtFM3uK5m3imrHuiff+puWV355FXw/+zuWV355FXw/+DuWV355FP:cEYzEFTgtFM3ukm3imPnt
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/756-183-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/756-95-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/756-147-0x0000000000400000-0x000000000041F000-memory.dmp

Download

memory/756-175-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/1072-122-0x00000000023D0000-0x0000000002573000-memory.dmp

Download

memory/1072-121-0x0000000000400000-0x0000000000623000-memory.dmp

Download

memory/1072-113-0x0000000000690000-0x00000000006A3000-memory.dmp

Download

memory/1120-167-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/1120-154-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/1276-168-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/1276-162-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/1304-182-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/1304-186-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/1512-153-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/1512-73-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/1520-126-0x0000000000400000-0x0000000000497000-memory.dmp

Download

memory/1520-125-0x0000000000220000-0x0000000000275000-memory.dmp

Download

memory/1520-123-0x000000000059E000-0x00000000005ED000-memory.dmp

Download

memory/1584-161-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/1584-72-0x0000000074B20000-0x00000000750CB000-memory.dmp

Download

memory/1584-63-0x0000000076261000-0x0000000076263000-memory.dmp

Download

memory/1660-62-0x000007FEF46F0000-0x000007FEF5113000-memory.dmp

Download

memory/1784-120-0x0000000000260000-0x000000000026E000-memory.dmp

Download

memory/1836-93-0x00000000033E0000-0x00000000033FF000-memory.dmp

Download

memory/2032-54-0x000007FEF46F0000-0x000007FEF5113000-memory.dmp

Download

memory/2032-55-0x000007FEFC0D1000-0x000007FEFC0D3000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads