dfd920bbba4313d6ad82993e645ded74705b4d2a4feb06a6fa6023e6697e1703

Analysis

max time kernel
152s
max time network
48s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/10/2022, 15:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfd920bbba4313d6ad82993e645ded74705b4d2a4feb06a6fa6023e6697e1703.exe
Size

34KB
MD5

6fe6c2a7ea19dc56c4c823b68abeedb0
SHA1

ec03a07b9f99ea3c7fbf80a88c846e1ae390bc80
SHA256

dfd920bbba4313d6ad82993e645ded74705b4d2a4feb06a6fa6023e6697e1703
SHA512

8f708596ba442929ac8b72887ea3bb43738a77710cb76be099856764c994803ff844695dff81b1bc04165d9f0449b9aa53d6c58cb3c9209335da785da86c79d3
SSDEEP

192:1l5E3krTuntKy0peHDfCpHfBv+I4QwXt9V+jqu0G5KDJBvN:1M3PnQoHDCpHf4I4Qwdc0G5KDJhN

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 60 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\en-US	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\qwavedrv.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\tcpip.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\bfe.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\ndiscap.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\scfilter.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\ndiscap.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\scfilter.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\tcpip.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	dfd920bbba4313d6ad82993e645ded74705b4d2a4feb06a6fa6023e6697e1703.exe
File opened for modification	C:\Windows\SysWOW64\drivers\wimmount.sys	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\tcpip.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\bfe.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\ndiscap.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\qwavedrv.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\tcpip.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\scfilter.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\ndiscap.sys.mui	AE 0124 BE.exe
File created	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\scfilter.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\pacer.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\bfe.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\tcpip.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\bfe.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\bfe.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\de-DE	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\es-ES	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gm.dls	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\bfe.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\tcpip.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\pacer.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\scfilter.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\en-US	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\pacer.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\qwavedrv.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\fr-FR\pacer.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT\pacer.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\ja-JP\qwavedrv.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\fr-FR	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\ja-JP	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\qwavedrv.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\en-US\scfilter.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES\qwavedrv.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\it-IT	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\pacer.sys.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\UMDF\it-IT	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\es-ES	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\drivers\de-DE\ndiscap.sys.mui	AE 0124 BE.exe

Executes dropped EXE 4 IoCs

pid	Process
948	winlogon.exe
1204	AE 0124 BE.exe
376	winlogon.exe
1836	winlogon.exe

Loads dropped DLL 7 IoCs

pid	Process
2012	dfd920bbba4313d6ad82993e645ded74705b4d2a4feb06a6fa6023e6697e1703.exe
2012	dfd920bbba4313d6ad82993e645ded74705b4d2a4feb06a6fa6023e6697e1703.exe
1204	AE 0124 BE.exe
1204	AE 0124 BE.exe
948	winlogon.exe
948	winlogon.exe
1836	winlogon.exe

Drops desktop.ini file(s) 40 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Characters\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Raga\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Link\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Landscape\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Afternoon\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Cityscape\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Garden\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Savanna\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Quirky\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Web\Wallpaper\Architecture\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Web\Wallpaper\Nature\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Link\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Web\Wallpaper\Landscapes\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Calligraphy\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Delta\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Festival\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Offline Web Pages\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Web\Wallpaper\Characters\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Heritage\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Sonata\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Web\Wallpaper\Scenes\Desktop.ini	AE 0124 BE.exe

Drops autorun.inf file 1 TTPs 27 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\O:\Autorun.inf	winlogon.exe
File opened for modification	\??\W:\Autorun.inf	winlogon.exe
File opened for modification	\??\M:\Autorun.inf	winlogon.exe
File opened for modification	\??\S:\Autorun.inf	winlogon.exe
File opened for modification	\??\V:\Autorun.inf	winlogon.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	AE 0124 BE.exe
File opened for modification	D:\Autorun.inf	winlogon.exe
File opened for modification	\??\J:\Autorun.inf	winlogon.exe
File opened for modification	\??\K:\Autorun.inf	winlogon.exe
File opened for modification	\??\E:\Autorun.inf	winlogon.exe
File opened for modification	\??\G:\Autorun.inf	winlogon.exe
File opened for modification	\??\N:\Autorun.inf	winlogon.exe
File opened for modification	\??\Q:\Autorun.inf	winlogon.exe
File opened for modification	\??\X:\Autorun.inf	winlogon.exe
File opened for modification	\??\Y:\Autorun.inf	winlogon.exe
File opened for modification	\??\A:\Autorun.inf	winlogon.exe
File opened for modification	\??\H:\Autorun.inf	winlogon.exe
File opened for modification	\??\L:\Autorun.inf	winlogon.exe
File opened for modification	\??\F:\Autorun.inf	winlogon.exe
File opened for modification	\??\I:\Autorun.inf	winlogon.exe
File opened for modification	\??\R:\Autorun.inf	winlogon.exe
File opened for modification	\??\U:\Autorun.inf	winlogon.exe
File opened for modification	C:\Autorun.inf	winlogon.exe
File opened for modification	\??\Z:\Autorun.inf	winlogon.exe
File opened for modification	\??\B:\Autorun.inf	winlogon.exe
File opened for modification	\??\P:\Autorun.inf	winlogon.exe
File opened for modification	\??\T:\Autorun.inf	winlogon.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\KBDRU.DLL	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\nshwfp.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\prnca00z.inf_loc	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\chkntfs.exe.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\en-US\cryptext.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\dhcpcsvc6.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\mapi32.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\prnsv002.cat	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\capiprovider.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp003.inf_amd64_neutral_4480210763997eb4\Amd64\hpzurw71.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\rdvgwddm.inf_amd64_neutral_dd691eae66f3032d\rdvgumd64.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\net1kx64.inf_loc	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\wbem\stdprov.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\wbem\wscmisetup.mof	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\wbem\es-ES\ServiceModel.mfl	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnep00c.inf_amd64_neutral_f0d9ddf52f04765c\Amd64\EP0NOP8W.DXT	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\en-US\intl.cpl.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\Licenses\eval\Starter	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\apss.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnrc302.inf_amd64_ja-jp_64ee91a0bf7b132c\prnrc302.PNF	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\dlmanifests\WebDAVRedir-DL.man	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\gpedit.msc	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Security-SPP-Component-SKU-Starter-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\nv_lh.inf_amd64_neutral_bc69f20e3115af59	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\CNBJOP8F.DLL	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\Amd64\EP7MDL19.GPD	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-TerminalServices-WMIProvider-Package~31bf3856ad364e35~amd64~de-DE~6.1.7601.17514.cat	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\CNB7TDAA.ICM	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\authui.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\tapi32.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\EnterpriseN\license.rtf	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\msdtcVSp1res.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_neutral_b71dd3dadc5c3e27	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnky009.inf_amd64_neutral_8e54c9ff272b72f1\Amd64\KYFS3920.GPD	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnhp005.inf_amd64_neutral_914d6c300207814f\Amd64\hpc4600a.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnlx003.inf_amd64_neutral_d1510a8315a2ea0d\Amd64\LME234.GPD	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\en-US\webio.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-PhotoBasicPackage~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.cat	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\appidapi.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\tbssvc.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\Dism\it-IT\OSProvider.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnbr006.inf_amd64_neutral_f156853def526447\Amd64\BRH5340D.GPD	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\es-ES\filemgmt.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMESC5\IMSCPROP.exe	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\iscsiexe.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\Dism\es-ES\WimProvider.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnfx002.inf_amd64_neutral_b6dd354531184f64\Amd64\FXUCCM01.GPD	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\wialx004.inf_amd64_neutral_0a3a62ae6ed43127\wialx004.inf	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\en-US\shimgvw.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mdmhayes.inf_amd64_neutral_507db5d34d7acddc\mdmhayes.PNF	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\fr-FR\adpu320.inf_loc	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\it-IT\SensorsAlsDriver.inf_loc	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\wlanutil.dll.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\ja-JP\prnin004.inf_loc	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\usk.rs.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Links-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-WindowsMediaPlayer-Troubleshooters-Package~31bf3856ad364e35~amd64~en-US~6.1.7600.16385.cat	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\de-DE\netsstpa.inf_loc	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnbr007.inf_amd64_neutral_add2acf1d573aef0\Amd64\BRH405DN.GPD	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\Amd64\EP7UIP00.DLL	AE 0124 BE.exe
File opened for modification	C:\Windows\SysWOW64\ntvdm64.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\catroot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SystemRestore-Package~31bf3856ad364e35~amd64~it-IT~6.1.7601.17514.cat	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\mdmcm28.inf_amd64_neutral_d3fa0f62d3d7cea1	AE 0124 BE.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\battery.inf_amd64_neutral_cb8fa151a7b7cb80\battery.inf	AE 0124 BE.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-r..erycenter.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_862962138f072ac3	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-w..iagnostic.resources_31bf3856ad364e35_6.1.7601.17514_it-it_8b8c9fa299ec3580	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft.backgroun..nt.module.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8dbf2e4c46ccd2f2	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardCreateRoles.ascx.de.resx	AE 0124 BE.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\IIS.adml	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_arc.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3c55042f29067b76	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..r-wmerror.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_470d7290fc9e3d5b	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-n..tions-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4ecd34c61883da4e	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-waitfor_31bf3856ad364e35_6.1.7600.16385_none_b63c0c04dc872e59	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\normnfkd.nlp	AE 0124 BE.exe
File opened for modification	C:\Windows\PolicyDefinitions\en-US\InkWatson.adml	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-netbios-netapi_31bf3856ad364e35_6.1.7600.16385_none_3453fc4c6aafb4c5	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..rity-ntlm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1b191a08973b1077	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_prnhp002.inf_31bf3856ad364e35_6.1.7600.16385_none_2f4e6f72537f8faa	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-n..n-clients.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b8d28f31dfdedcba	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-smartcardksp_31bf3856ad364e35_6.1.7601.17514_none_b7f7d8e8e19ade8a	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Managemen#\e72886c96b63be364c0205b6c4ff4413\Microsoft.ManagementConsole.ni.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Cursors\aero_up_l.cur	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..-logagent.resources_31bf3856ad364e35_6.1.7600.16385_en-us_df23a1b9a7a8b3e3	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-t..cesclient.resources_31bf3856ad364e35_6.1.7601.17514_en-us_d2c3ba2684bde870	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-i..panese_ax2_keyboard_31bf3856ad364e35_6.1.7600.16385_none_22f14a2a1a13b4f4	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\security.aspx.de.resx	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\en\SqlWorkflowInstanceStoreSchemaUpgrade.sql	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_bthspp.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f435be2af5ccbe69\bthspp.inf_loc	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Web.Routing\3.5.0.0__31bf3856ad364e35\System.Web.Routing.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-f..e-microsoftjhenghei_31bf3856ad364e35_6.1.7600.16385_none_c135aa29f9c5f8da	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-w..ellibrary.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d08a911e26156d61	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-directx-xinput_31bf3856ad364e35_6.1.7600.16385_none_32ce1c4d9f461d17	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-u..dem-voice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1c9f3fffd349960b	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-directshow-dvdplay_31bf3856ad364e35_6.1.7600.16385_none_5da314d233bb2676	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_ddd3dce8899a66c5	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ponents-mdac-sqlxml_31bf3856ad364e35_6.1.7600.16385_none_75682ef78730fe19	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Data.OracleClient.resources\2.0.0.0_es_b77a5c561934e089	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servf73e6522#\60b93ce08d30a2fba087f8630a504cb8\System.ServiceModel.Web.ni.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\ehome\MediaRenderer\MediaCenter.DigitalMediaRenderer.RenderingControlNoMute.xml	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\mui\0407\cliconf.chm	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\prnky007.inf	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_84ce947a2303d09d	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_hpoa1sd.inf_31bf3856ad364e35_6.1.7600.16385_none_abdb7466c14b5a38\hpotscld.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-a..wdm-audio.resources_31bf3856ad364e35_6.1.7600.16385_it-it_59539415e5b683b6	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-d..input-cpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_616aa16ae90b1456	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-h..oup-provsvc-license_31bf3856ad364e35_6.1.7600.16385_none_d112db7515584cf3	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Speech.resources\3.0.0.0_es_31bf3856ad364e35\System.Speech.resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\e27ae693b6e71bb689ec66761a65901f\System.ServiceModel.ni.dll.aux	AE 0124 BE.exe
File opened for modification	C:\Windows\PolicyDefinitions\it-IT\ShellWelcomeCenter.adml	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\tokens.dat	AE 0124 BE.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Media-Format-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.cat	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\887ef2648686aad19feff405eddbffd2\System.EnterpriseServices.ni.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\PERFLIB\040C\perfi.dat	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-msmpeg2enc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5ace9aeb4494cbd2	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-scheduleui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_565288a92e180282	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wincal-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7165d67fd7e7864a	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_prnep00c.inf_31bf3856ad364e35_6.1.7600.16385_none_adb67b12e1bb863e	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\napinit.resources\6.1.0.0_de_31bf3856ad364e35\napinit.Resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Cursors\size2_m.cur	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\PERFLIB\0410\perfi.dat	AE 0124 BE.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-TerminalServices-WMIProvider-Package~31bf3856ad364e35~amd64~ja-JP~6.1.7601.17514.mum	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-soundrec-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_68ee10647c81d8ff	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ja\ServiceModelReg.resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\servicing\Packages\Win8IP-Microsoft-Windows-DownlevelApisets-WinIP-Package~31bf3856ad364e35~amd64~fi-FI~7.1.7601.16492.mum	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5646c597a746df57	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\UIAutomationProvider\3.0.0.0__31bf3856ad364e35	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\.NET CLR Data\0409	AE 0124 BE.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..l-chinese-migration_31bf3856ad364e35_6.1.7600.16385_none_d701c6600ec6b7e1	AE 0124 BE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2012	dfd920bbba4313d6ad82993e645ded74705b4d2a4feb06a6fa6023e6697e1703.exe
948	winlogon.exe
1204	AE 0124 BE.exe
376	winlogon.exe
1836	winlogon.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 948	2012	dfd920bbba4313d6ad82993e645ded74705b4d2a4feb06a6fa6023e6697e1703.exe	28
PID 2012 wrote to memory of 948	2012	dfd920bbba4313d6ad82993e645ded74705b4d2a4feb06a6fa6023e6697e1703.exe	28
PID 2012 wrote to memory of 948	2012	dfd920bbba4313d6ad82993e645ded74705b4d2a4feb06a6fa6023e6697e1703.exe	28
PID 2012 wrote to memory of 948	2012	dfd920bbba4313d6ad82993e645ded74705b4d2a4feb06a6fa6023e6697e1703.exe	28
PID 948 wrote to memory of 1204	948	winlogon.exe	29
PID 948 wrote to memory of 1204	948	winlogon.exe	29
PID 948 wrote to memory of 1204	948	winlogon.exe	29
PID 948 wrote to memory of 1204	948	winlogon.exe	29
PID 1204 wrote to memory of 376	1204	AE 0124 BE.exe	30
PID 1204 wrote to memory of 376	1204	AE 0124 BE.exe	30
PID 1204 wrote to memory of 376	1204	AE 0124 BE.exe	30
PID 1204 wrote to memory of 376	1204	AE 0124 BE.exe	30
PID 948 wrote to memory of 1836	948	winlogon.exe	31
PID 948 wrote to memory of 1836	948	winlogon.exe	31
PID 948 wrote to memory of 1836	948	winlogon.exe	31
PID 948 wrote to memory of 1836	948	winlogon.exe	31

C:\Users\Admin\AppData\Local\Temp\dfd920bbba4313d6ad82993e645ded74705b4d2a4feb06a6fa6023e6697e1703.exe
"C:\Users\Admin\AppData\Local\Temp\dfd920bbba4313d6ad82993e645ded74705b4d2a4feb06a6fa6023e6697e1703.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\SysWOW64\drivers\winlogon.exe
  "C:\Windows\System32\drivers\winlogon.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops autorun.inf file
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\AE 0124 BE.exe
    "C:\Windows\AE 0124 BE.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops desktop.ini file(s)
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:376
- - C:\Windows\SysWOW64\drivers\winlogon.exe
    "C:\Windows\System32\drivers\winlogon.exe"
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:1836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AE 0124 BE.ani

Filesize
54KB

MD5
79d2106479bcd48f6700dfdcb132f942

SHA1
438afbe8ca1430b61ce1bcbedd506c8f7a158adf

SHA256
a83a54bd98b5a4afdab4605b876f3ad44224107261af850f107e702116cf357e

SHA512
fedc303cdd5627cd10ea8b0e4cf7e694758ec7864f965f379296745841c2ff66a3107d31c0dacd1ae49951156764b48e5b201276091fa7581c2abb3b028d03a5

Download Submit
C:\Windows\AE 0124 BE.exe

Filesize
40KB

MD5
3f171f3bd6338f92c9b1d857cb73a32f

SHA1
0ef82cc3f4ed33154dbcf9b8fd3c8a9cfa7d2800

SHA256
e124418b959ea3c57874af35441dc14ad3568a239c110dab41b1b56416d43bd3

SHA512
163e7274fc1a9aab383ee2fa34c3c0bed16ecab1565df106650ce7d2f8fe02f3ddec70592bd3903ced3e88581731611e261233bbce6dfa60c4e0e604fe5ce1fb

Download Submit
C:\Windows\AE 0124 BE.exe

Filesize
40KB

MD5
3f171f3bd6338f92c9b1d857cb73a32f

SHA1
0ef82cc3f4ed33154dbcf9b8fd3c8a9cfa7d2800

SHA256
e124418b959ea3c57874af35441dc14ad3568a239c110dab41b1b56416d43bd3

SHA512
163e7274fc1a9aab383ee2fa34c3c0bed16ecab1565df106650ce7d2f8fe02f3ddec70592bd3903ced3e88581731611e261233bbce6dfa60c4e0e604fe5ce1fb

Download Submit
C:\Windows\Msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\drivers\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
3f171f3bd6338f92c9b1d857cb73a32f

SHA1
0ef82cc3f4ed33154dbcf9b8fd3c8a9cfa7d2800

SHA256
e124418b959ea3c57874af35441dc14ad3568a239c110dab41b1b56416d43bd3

SHA512
163e7274fc1a9aab383ee2fa34c3c0bed16ecab1565df106650ce7d2f8fe02f3ddec70592bd3903ced3e88581731611e261233bbce6dfa60c4e0e604fe5ce1fb

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
3f171f3bd6338f92c9b1d857cb73a32f

SHA1
0ef82cc3f4ed33154dbcf9b8fd3c8a9cfa7d2800

SHA256
e124418b959ea3c57874af35441dc14ad3568a239c110dab41b1b56416d43bd3

SHA512
163e7274fc1a9aab383ee2fa34c3c0bed16ecab1565df106650ce7d2f8fe02f3ddec70592bd3903ced3e88581731611e261233bbce6dfa60c4e0e604fe5ce1fb

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
3f171f3bd6338f92c9b1d857cb73a32f

SHA1
0ef82cc3f4ed33154dbcf9b8fd3c8a9cfa7d2800

SHA256
e124418b959ea3c57874af35441dc14ad3568a239c110dab41b1b56416d43bd3

SHA512
163e7274fc1a9aab383ee2fa34c3c0bed16ecab1565df106650ce7d2f8fe02f3ddec70592bd3903ced3e88581731611e261233bbce6dfa60c4e0e604fe5ce1fb

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
3f171f3bd6338f92c9b1d857cb73a32f

SHA1
0ef82cc3f4ed33154dbcf9b8fd3c8a9cfa7d2800

SHA256
e124418b959ea3c57874af35441dc14ad3568a239c110dab41b1b56416d43bd3

SHA512
163e7274fc1a9aab383ee2fa34c3c0bed16ecab1565df106650ce7d2f8fe02f3ddec70592bd3903ced3e88581731611e261233bbce6dfa60c4e0e604fe5ce1fb

Download Submit
\??\c:\B1uv3nth3x1.diz

Filesize
25B

MD5
589b6886a49054d03b739309a1de9fcc

SHA1
0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

SHA256
564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

SHA512
4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

Download Submit
\??\c:\B1uv3nth3x1.diz

Filesize
25B

MD5
589b6886a49054d03b739309a1de9fcc

SHA1
0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

SHA256
564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

SHA512
4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

Download Submit
\Windows\SysWOW64\drivers\Msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
3f171f3bd6338f92c9b1d857cb73a32f

SHA1
0ef82cc3f4ed33154dbcf9b8fd3c8a9cfa7d2800

SHA256
e124418b959ea3c57874af35441dc14ad3568a239c110dab41b1b56416d43bd3

SHA512
163e7274fc1a9aab383ee2fa34c3c0bed16ecab1565df106650ce7d2f8fe02f3ddec70592bd3903ced3e88581731611e261233bbce6dfa60c4e0e604fe5ce1fb

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
3f171f3bd6338f92c9b1d857cb73a32f

SHA1
0ef82cc3f4ed33154dbcf9b8fd3c8a9cfa7d2800

SHA256
e124418b959ea3c57874af35441dc14ad3568a239c110dab41b1b56416d43bd3

SHA512
163e7274fc1a9aab383ee2fa34c3c0bed16ecab1565df106650ce7d2f8fe02f3ddec70592bd3903ced3e88581731611e261233bbce6dfa60c4e0e604fe5ce1fb

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
3f171f3bd6338f92c9b1d857cb73a32f

SHA1
0ef82cc3f4ed33154dbcf9b8fd3c8a9cfa7d2800

SHA256
e124418b959ea3c57874af35441dc14ad3568a239c110dab41b1b56416d43bd3

SHA512
163e7274fc1a9aab383ee2fa34c3c0bed16ecab1565df106650ce7d2f8fe02f3ddec70592bd3903ced3e88581731611e261233bbce6dfa60c4e0e604fe5ce1fb

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
3f171f3bd6338f92c9b1d857cb73a32f

SHA1
0ef82cc3f4ed33154dbcf9b8fd3c8a9cfa7d2800

SHA256
e124418b959ea3c57874af35441dc14ad3568a239c110dab41b1b56416d43bd3

SHA512
163e7274fc1a9aab383ee2fa34c3c0bed16ecab1565df106650ce7d2f8fe02f3ddec70592bd3903ced3e88581731611e261233bbce6dfa60c4e0e604fe5ce1fb

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
3f171f3bd6338f92c9b1d857cb73a32f

SHA1
0ef82cc3f4ed33154dbcf9b8fd3c8a9cfa7d2800

SHA256
e124418b959ea3c57874af35441dc14ad3568a239c110dab41b1b56416d43bd3

SHA512
163e7274fc1a9aab383ee2fa34c3c0bed16ecab1565df106650ce7d2f8fe02f3ddec70592bd3903ced3e88581731611e261233bbce6dfa60c4e0e604fe5ce1fb

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
3f171f3bd6338f92c9b1d857cb73a32f

SHA1
0ef82cc3f4ed33154dbcf9b8fd3c8a9cfa7d2800

SHA256
e124418b959ea3c57874af35441dc14ad3568a239c110dab41b1b56416d43bd3

SHA512
163e7274fc1a9aab383ee2fa34c3c0bed16ecab1565df106650ce7d2f8fe02f3ddec70592bd3903ced3e88581731611e261233bbce6dfa60c4e0e604fe5ce1fb

Download Submit
memory/1204-74-0x0000000002601000-0x0000000002B4D000-memory.dmp

Filesize
5.3MB

Download
memory/2012-56-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/2012-57-0x00000000026E1000-0x0000000002C2D000-memory.dmp

Filesize
5.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads