c6ceb02cd726cc4d3b14bd425db38f1be24bfbebdbda8d18738947d733344a6a

Analysis

max time kernel
151s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6ceb02cd726cc4d3b14bd425db38f1be24bfbebdbda8d18738947d733344a6a.exe
Size

68KB
MD5

657af217dc7ff720a69b95eecca650a0
SHA1

8c3b480ffae6ff786e02758be7b7e3e49b5972e6
SHA256

c6ceb02cd726cc4d3b14bd425db38f1be24bfbebdbda8d18738947d733344a6a
SHA512

38881daef71909b2ee389a376b5d7b1168b4cc1e6db4de1d2b75e18f0effbfc310632407db2c7675e66f459820363b905595f7e17f1c12bb7fae0bf425518303
SSDEEP

1536:sr+Fum5LMI+WTJjcXnXMcpm/zOxJXKJt1:sr+Fu2II+HXXMcI/AKJb

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	c6ceb02cd726cc4d3b14bd425db38f1be24bfbebdbda8d18738947d733344a6a.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File created	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe

Executes dropped EXE 4 IoCs

pid	Process
788	winlogon.exe
1448	AE 0124 BE.exe
308	winlogon.exe
1076	winlogon.exe

Loads dropped DLL 7 IoCs

pid	Process
1408	c6ceb02cd726cc4d3b14bd425db38f1be24bfbebdbda8d18738947d733344a6a.exe
1408	c6ceb02cd726cc4d3b14bd425db38f1be24bfbebdbda8d18738947d733344a6a.exe
788	winlogon.exe
788	winlogon.exe
1448	AE 0124 BE.exe
1448	AE 0124 BE.exe
1076	winlogon.exe

Drops desktop.ini file(s) 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Delta\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Savanna\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Link\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Festival\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Garden\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Sonata\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Link\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Characters\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Landscape\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Quirky\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Afternoon\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Calligraphy\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Cityscape\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Heritage\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Raga\Desktop.ini	AE 0124 BE.exe

Drops autorun.inf file 1 TTPs 25 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Autorun.inf	winlogon.exe
File opened for modification	\??\G:\Autorun.inf	winlogon.exe
File opened for modification	\??\P:\Autorun.inf	winlogon.exe
File opened for modification	\??\V:\Autorun.inf	winlogon.exe
File opened for modification	\??\W:\Autorun.inf	winlogon.exe
File opened for modification	\??\H:\Autorun.inf	winlogon.exe
File opened for modification	\??\M:\Autorun.inf	winlogon.exe
File opened for modification	\??\N:\Autorun.inf	winlogon.exe
File opened for modification	\??\S:\Autorun.inf	winlogon.exe
File opened for modification	\??\U:\Autorun.inf	winlogon.exe
File opened for modification	\??\X:\Autorun.inf	winlogon.exe
File opened for modification	\??\Z:\Autorun.inf	winlogon.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	AE 0124 BE.exe
File opened for modification	\??\E:\Autorun.inf	winlogon.exe
File opened for modification	\??\F:\Autorun.inf	winlogon.exe
File opened for modification	\??\J:\Autorun.inf	winlogon.exe
File opened for modification	\??\L:\Autorun.inf	winlogon.exe
File opened for modification	\??\O:\Autorun.inf	winlogon.exe
File opened for modification	\??\Q:\Autorun.inf	winlogon.exe
File opened for modification	D:\Autorun.inf	winlogon.exe
File opened for modification	\??\I:\Autorun.inf	winlogon.exe
File opened for modification	\??\K:\Autorun.inf	winlogon.exe
File opened for modification	\??\R:\Autorun.inf	winlogon.exe
File opened for modification	\??\T:\Autorun.inf	winlogon.exe
File opened for modification	\??\Y:\Autorun.inf	winlogon.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\regedit.exe	AE 0124 BE.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ehome\de-DE\ehdebug.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\FREESCPT.TTF	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\tdibth.PNF	AE 0124 BE.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1D5E3C0FEDA1E123187686FED06E995A\10.0.40219\F_CENTRAL_mfc100fra_x86	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Diagnostics.Resources	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualBas#\684eae3bcd28cb6d1e6997e6497056e2	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\index\WindowsMediaPlayerConfiguration.xml	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\UIAutomationClient	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\Networking\ja-JP\DiagPackage.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\Search\it-IT\CL_LocalizationData.psd1	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\Windows\es-ES\efsfull.h1s	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_ja_b77a5c561934e089\System.Windows.Forms.Resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Windows.Presentation.resources\3.5.0.0_de_b77a5c561934e089	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\WindowsBase.resources\3.0.0.0_de_31bf3856ad364e35\WindowsBase.resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.Tracing	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\net1kx64.PNF	AE 0124 BE.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\1926E8D15D0BCE53481466615F760A7F\10.0.40219\F_CENTRAL_mfc100u_x64	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.tlb	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\CONFIG\web.config	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_64\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\SYSTEM.CONFIGURATION.resources	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a	AE 0124 BE.exe
File opened for modification	C:\Windows\ehome\wow\de-DE\ehdebug.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\es	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\Windows\it-IT\touch.h1s	AE 0124 BE.exe
File opened for modification	C:\Windows\IME\IMEJP10\DICTS\IMJPST.DIC	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_64\Microsoft.MediaCenter.Playback\6.1.0.0__31bf3856ad364e35\Microsoft.MediaCenter.Playback.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Interop.Publisher	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\RAVIE.TTF	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\mui\0C0A\sys_srv.CHM	AE 0124 BE.exe
File opened for modification	C:\Windows\Boot\DVD\PCAT\fr-FR	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Landscape\Windows Battery Critical.wav	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Deployment.resources\2.0.0.0_es_b03f5f7f11d50a3a	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\62a6b39f4f68c25dfd2f6308d7541401\System.Runtime.Serialization.ni.dll.aux	AE 0124 BE.exe
File opened for modification	C:\Windows\Cursors\no_il.cur	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\sdbus.inf	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Data.Services	AE 0124 BE.exe
File opened for modification	C:\Windows\ehome\wtv2dvrms.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\cambria.ttc	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\mui\0407\tpmadmin.CHM	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\REFSPCL.TTF	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\Windows\de-DE\domain.h1s	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\wstorvsc.inf	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\.NETFramework\0C0A\corperfmonsymbols_D.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Data.Linq\3.5.0.0__b77a5c561934e089	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\system.workflow.componentmodel.resources\3.0.0.0_de_31bf3856ad364e35	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\97e047cf68e9a7d90e196d072cd49cac	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\System\095a3392942c3d4eb888e6a32036acd8	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xml.XmlDocument	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\SmtpSettings.aspx.de.resx	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.GetDiagInput\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\Windows\fr-FR\winmeetb.h1s	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.resources	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.SmartTag.config	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Link\US-1.url	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Web.Services.resources\2.0.0.0_es_b03f5f7f11d50a3a	AE 0124 BE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1088	DllHost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1408	c6ceb02cd726cc4d3b14bd425db38f1be24bfbebdbda8d18738947d733344a6a.exe
788	winlogon.exe
1448	AE 0124 BE.exe
1076	winlogon.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1408 wrote to memory of 788	1408	c6ceb02cd726cc4d3b14bd425db38f1be24bfbebdbda8d18738947d733344a6a.exe	27
PID 1408 wrote to memory of 788	1408	c6ceb02cd726cc4d3b14bd425db38f1be24bfbebdbda8d18738947d733344a6a.exe	27
PID 1408 wrote to memory of 788	1408	c6ceb02cd726cc4d3b14bd425db38f1be24bfbebdbda8d18738947d733344a6a.exe	27
PID 1408 wrote to memory of 788	1408	c6ceb02cd726cc4d3b14bd425db38f1be24bfbebdbda8d18738947d733344a6a.exe	27
PID 788 wrote to memory of 1448	788	winlogon.exe	28
PID 788 wrote to memory of 1448	788	winlogon.exe	28
PID 788 wrote to memory of 1448	788	winlogon.exe	28
PID 788 wrote to memory of 1448	788	winlogon.exe	28
PID 788 wrote to memory of 308	788	winlogon.exe	29
PID 788 wrote to memory of 308	788	winlogon.exe	29
PID 788 wrote to memory of 308	788	winlogon.exe	29
PID 788 wrote to memory of 308	788	winlogon.exe	29
PID 1448 wrote to memory of 1076	1448	AE 0124 BE.exe	30
PID 1448 wrote to memory of 1076	1448	AE 0124 BE.exe	30
PID 1448 wrote to memory of 1076	1448	AE 0124 BE.exe	30
PID 1448 wrote to memory of 1076	1448	AE 0124 BE.exe	30

C:\Users\Admin\AppData\Local\Temp\c6ceb02cd726cc4d3b14bd425db38f1be24bfbebdbda8d18738947d733344a6a.exe
"C:\Users\Admin\AppData\Local\Temp\c6ceb02cd726cc4d3b14bd425db38f1be24bfbebdbda8d18738947d733344a6a.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408
- C:\Windows\SysWOW64\drivers\winlogon.exe
  "C:\Windows\System32\drivers\winlogon.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops autorun.inf file
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Windows\AE 0124 BE.exe
    "C:\Windows\AE 0124 BE.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops desktop.ini file(s)
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1448
  - - C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:1076
- - C:\Windows\SysWOW64\drivers\winlogon.exe
    "C:\Windows\System32\drivers\winlogon.exe"
    3⤵
    - Executes dropped EXE
    PID:308

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AE 0124 BE.exe

Filesize
130KB

MD5
dc900366f74a5617aaa67f9828ce3de2

SHA1
2708532bab29608ad23fa82fde14e9d6a7aa80bf

SHA256
661bfbbf7a493ff0ceccfced092a7d96d81ecc7e5e5e9f7b08bf6d570a20e2c0

SHA512
7e183040854e17de6ffb634f6b6410194d57079eb8156902ec6b6e43f53a37dc9850f532d7e45bd9c3e8d3be7e7645288f165c02539b36d7f2cbf341912a0551

Download Submit
C:\Windows\AE 0124 BE.exe

Filesize
130KB

MD5
dc900366f74a5617aaa67f9828ce3de2

SHA1
2708532bab29608ad23fa82fde14e9d6a7aa80bf

SHA256
661bfbbf7a493ff0ceccfced092a7d96d81ecc7e5e5e9f7b08bf6d570a20e2c0

SHA512
7e183040854e17de6ffb634f6b6410194d57079eb8156902ec6b6e43f53a37dc9850f532d7e45bd9c3e8d3be7e7645288f165c02539b36d7f2cbf341912a0551

Download Submit
C:\Windows\AE 0124 BE.jpg

Filesize
133KB

MD5
7350aa8f068f09e0c50fcb936a2bd811

SHA1
ebe35a257a7f9535e1ca7577aba55fc67b0228a8

SHA256
f56dfb6baf75ddf34a373d349743dd315ddc42cddda509bdef9fcd847c4aa32f

SHA512
4e5cafe1d52418a8e3481a0ade5043bc596bdea2434d3ba32260f4b01aec8f3555304892046d9c08e0f0d09faa90f5ab4894f6bd19ed517befd6e190a0e53e64

Download Submit
C:\Windows\AE 0124 BE.jpg

Filesize
133KB

MD5
7350aa8f068f09e0c50fcb936a2bd811

SHA1
ebe35a257a7f9535e1ca7577aba55fc67b0228a8

SHA256
f56dfb6baf75ddf34a373d349743dd315ddc42cddda509bdef9fcd847c4aa32f

SHA512
4e5cafe1d52418a8e3481a0ade5043bc596bdea2434d3ba32260f4b01aec8f3555304892046d9c08e0f0d09faa90f5ab4894f6bd19ed517befd6e190a0e53e64

Download Submit
C:\Windows\Msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\drivers\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
dc900366f74a5617aaa67f9828ce3de2

SHA1
2708532bab29608ad23fa82fde14e9d6a7aa80bf

SHA256
661bfbbf7a493ff0ceccfced092a7d96d81ecc7e5e5e9f7b08bf6d570a20e2c0

SHA512
7e183040854e17de6ffb634f6b6410194d57079eb8156902ec6b6e43f53a37dc9850f532d7e45bd9c3e8d3be7e7645288f165c02539b36d7f2cbf341912a0551

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
dc900366f74a5617aaa67f9828ce3de2

SHA1
2708532bab29608ad23fa82fde14e9d6a7aa80bf

SHA256
661bfbbf7a493ff0ceccfced092a7d96d81ecc7e5e5e9f7b08bf6d570a20e2c0

SHA512
7e183040854e17de6ffb634f6b6410194d57079eb8156902ec6b6e43f53a37dc9850f532d7e45bd9c3e8d3be7e7645288f165c02539b36d7f2cbf341912a0551

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
dc900366f74a5617aaa67f9828ce3de2

SHA1
2708532bab29608ad23fa82fde14e9d6a7aa80bf

SHA256
661bfbbf7a493ff0ceccfced092a7d96d81ecc7e5e5e9f7b08bf6d570a20e2c0

SHA512
7e183040854e17de6ffb634f6b6410194d57079eb8156902ec6b6e43f53a37dc9850f532d7e45bd9c3e8d3be7e7645288f165c02539b36d7f2cbf341912a0551

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
dc900366f74a5617aaa67f9828ce3de2

SHA1
2708532bab29608ad23fa82fde14e9d6a7aa80bf

SHA256
661bfbbf7a493ff0ceccfced092a7d96d81ecc7e5e5e9f7b08bf6d570a20e2c0

SHA512
7e183040854e17de6ffb634f6b6410194d57079eb8156902ec6b6e43f53a37dc9850f532d7e45bd9c3e8d3be7e7645288f165c02539b36d7f2cbf341912a0551

Download Submit
\??\c:\B1uv3nth3x1.diz

Filesize
21B

MD5
9cceaa243c5d161e1ce41c7dad1903dd

SHA1
e3da72675df53fffa781d4377d1d62116eafb35b

SHA256
814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

SHA512
af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

Download Submit
\??\c:\B1uv3nth3x1.diz

Filesize
21B

MD5
9cceaa243c5d161e1ce41c7dad1903dd

SHA1
e3da72675df53fffa781d4377d1d62116eafb35b

SHA256
814649b436ea43dd2abb99693e06019d4079ee74d02a0395913add0ba92d0189

SHA512
af9b75dc9a0b39d12d48bf6d40eb7d778eb9dd976302792271d8d4245a916027cf4e705d6cd7a5e6582ba94953346f291122f27d377b2c1a86e45f49e92efb5b

Download Submit
\Windows\SysWOW64\drivers\Msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
dc900366f74a5617aaa67f9828ce3de2

SHA1
2708532bab29608ad23fa82fde14e9d6a7aa80bf

SHA256
661bfbbf7a493ff0ceccfced092a7d96d81ecc7e5e5e9f7b08bf6d570a20e2c0

SHA512
7e183040854e17de6ffb634f6b6410194d57079eb8156902ec6b6e43f53a37dc9850f532d7e45bd9c3e8d3be7e7645288f165c02539b36d7f2cbf341912a0551

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
dc900366f74a5617aaa67f9828ce3de2

SHA1
2708532bab29608ad23fa82fde14e9d6a7aa80bf

SHA256
661bfbbf7a493ff0ceccfced092a7d96d81ecc7e5e5e9f7b08bf6d570a20e2c0

SHA512
7e183040854e17de6ffb634f6b6410194d57079eb8156902ec6b6e43f53a37dc9850f532d7e45bd9c3e8d3be7e7645288f165c02539b36d7f2cbf341912a0551

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
dc900366f74a5617aaa67f9828ce3de2

SHA1
2708532bab29608ad23fa82fde14e9d6a7aa80bf

SHA256
661bfbbf7a493ff0ceccfced092a7d96d81ecc7e5e5e9f7b08bf6d570a20e2c0

SHA512
7e183040854e17de6ffb634f6b6410194d57079eb8156902ec6b6e43f53a37dc9850f532d7e45bd9c3e8d3be7e7645288f165c02539b36d7f2cbf341912a0551

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
dc900366f74a5617aaa67f9828ce3de2

SHA1
2708532bab29608ad23fa82fde14e9d6a7aa80bf

SHA256
661bfbbf7a493ff0ceccfced092a7d96d81ecc7e5e5e9f7b08bf6d570a20e2c0

SHA512
7e183040854e17de6ffb634f6b6410194d57079eb8156902ec6b6e43f53a37dc9850f532d7e45bd9c3e8d3be7e7645288f165c02539b36d7f2cbf341912a0551

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
dc900366f74a5617aaa67f9828ce3de2

SHA1
2708532bab29608ad23fa82fde14e9d6a7aa80bf

SHA256
661bfbbf7a493ff0ceccfced092a7d96d81ecc7e5e5e9f7b08bf6d570a20e2c0

SHA512
7e183040854e17de6ffb634f6b6410194d57079eb8156902ec6b6e43f53a37dc9850f532d7e45bd9c3e8d3be7e7645288f165c02539b36d7f2cbf341912a0551

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
130KB

MD5
dc900366f74a5617aaa67f9828ce3de2

SHA1
2708532bab29608ad23fa82fde14e9d6a7aa80bf

SHA256
661bfbbf7a493ff0ceccfced092a7d96d81ecc7e5e5e9f7b08bf6d570a20e2c0

SHA512
7e183040854e17de6ffb634f6b6410194d57079eb8156902ec6b6e43f53a37dc9850f532d7e45bd9c3e8d3be7e7645288f165c02539b36d7f2cbf341912a0551

Download Submit
memory/1408-56-0x00000000750A1000-0x00000000750A3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads