0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2022, 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
Size

311KB
MD5

ae818789e882bfcf593407f2cf2644de
SHA1

6d796bf7662bf1ce0eae093f89c2405d0c2ed800
SHA256

0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984
SHA512

19363bb8a1c3dfbd1913517801bf1ce5655a8d6d3bafde8f2877cb6f6a7453d33e7dca0f437adedd294c1e7075fe70e53afd0a8c200775bf669b3f0aaf86062a
SSDEEP

6144:JY+32WWluqvHpVmXWEjFJRWci+WUd20rUU5EYCTvaBju4J:OnWwvHpVmXpjJIUd2cUusvalxJ

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\\NFL3V0E.exe\""	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\\NFL3V0E.exe\""	lsass.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe

ACProtect 1.3x - 1.4x DLL software 4 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000022f48-161.dat	acprotect
behavioral2/files/0x0007000000022f48-160.dat	acprotect
behavioral2/files/0x0007000000022f48-163.dat	acprotect
behavioral2/files/0x0007000000022f48-165.dat	acprotect

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Executes dropped EXE 5 IoCs

pid	Process
4928	service.exe
4988	smss.exe
1480	system.exe
2416	winlogon.exe
2532	lsass.exe

Sets file execution options in registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\\regedit.cmd"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000022f48-161.dat	upx
behavioral2/files/0x0007000000022f48-160.dat	upx
behavioral2/files/0x0007000000022f48-163.dat	upx
behavioral2/files/0x0007000000022f48-165.dat	upx
behavioral2/memory/1480-224-0x0000000010000000-0x0000000010075000-memory.dmp	upx
behavioral2/memory/1480-226-0x0000000010000000-0x0000000010075000-memory.dmp	upx

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	lsass.exe

Loads dropped DLL 1 IoCs

pid	Process
1480	system.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RUN	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0V0ERD = "C:\\Windows\\HKU4E6K.exe"	system.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\RUN	lsass.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sJP4E6K0 = "C:\\Windows\\system32\\QLK0R5MMRD8W8U.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RUN	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0V0ERD = "C:\\Windows\\HKU4E6K.exe"	lsass.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\RUN	system.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sJP4E6K0 = "C:\\Windows\\system32\\QLK0R5MMRD8W8U.exe"	system.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	service.exe
File opened (read-only)	\??\V:	service.exe
File opened (read-only)	\??\E:	service.exe
File opened (read-only)	\??\H:	service.exe
File opened (read-only)	\??\J:	service.exe
File opened (read-only)	\??\N:	service.exe
File opened (read-only)	\??\Q:	service.exe
File opened (read-only)	\??\R:	service.exe
File opened (read-only)	\??\Y:	service.exe
File opened (read-only)	\??\K:	service.exe
File opened (read-only)	\??\S:	service.exe
File opened (read-only)	\??\Z:	service.exe
File opened (read-only)	\??\F:	service.exe
File opened (read-only)	\??\G:	service.exe
File opened (read-only)	\??\M:	service.exe
File opened (read-only)	\??\O:	service.exe
File opened (read-only)	\??\P:	service.exe
File opened (read-only)	\??\I:	service.exe
File opened (read-only)	\??\L:	service.exe
File opened (read-only)	\??\U:	service.exe
File opened (read-only)	\??\W:	service.exe
File opened (read-only)	\??\X:	service.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\systear.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\SysWOW64\QLK0R5MMRD8W8U.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\WVC4H3R.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IXC5F6O	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IXC5F6O\QLK0R5M.cmd	service.exe
File opened for modification	C:\Windows\SysWOW64\IXC5F6O\QLK0R5M.cmd	smss.exe
File opened for modification	C:\Windows\SysWOW64\WVC4H3R.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\IXC5F6O\QLK0R5M.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\QLK0R5MMRD8W8U.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\SysWOW64\IXC5F6O	smss.exe
File opened for modification	C:\Windows\SysWOW64\WVC4H3R.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\WVC4H3R.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\WVC4H3R.exe	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IXC5F6O	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\QLK0R5MMRD8W8U.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\IXC5F6O	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\QLK0R5MMRD8W8U.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\QLK0R5MMRD8W8U.exe	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\IXC5F6O\QLK0R5M.cmd	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\IXC5F6O	lsass.exe
File opened for modification	C:\Windows\SysWOW64\IXC5F6O\QLK0R5M.cmd	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\SysWOW64\WVC4H3R.exe	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\SysWOW64\IXC5F6O\QLK0R5M.cmd	lsass.exe
File opened for modification	C:\Windows\SysWOW64\IXC5F6O	service.exe
File opened for modification	C:\Windows\SysWOW64\QLK0R5MMRD8W8U.exe	winlogon.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	winlogon.exe
File opened for modification	C:\Windows\lsass.exe	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\HKU4E6K.exe	service.exe
File opened for modification	C:\Windows\HKU4E6K.exe	system.exe
File opened for modification	C:\Windows\cypreg.dll	smss.exe
File opened for modification	C:\Windows\lsass.exe	system.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\NFL3V0E.exe	system.exe
File opened for modification	C:\Windows\MRD8W8U.exe	winlogon.exe
File opened for modification	C:\Windows\moonlight.dll	service.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}	service.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}	system.exe
File opened for modification	C:\Windows\cypreg.dll	service.exe
File created	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\zia02092	system.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\NFL3V0E.exe	smss.exe
File created	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\MYpIC.zip	system.exe
File opened for modification	C:\Windows\cypreg.dll	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\EHE4I2Y.com	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	service.exe
File opened for modification	C:\Windows\cypreg.dll	winlogon.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	smss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	smss.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	lsass.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	winlogon.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	lsass.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	service.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	smss.exe
File opened for modification	C:\Windows\MRD8W8U.exe	service.exe
File opened for modification	C:\Windows\moonlight.dll	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}	smss.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	service.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\EHE4I2Y.com	system.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	winlogon.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	winlogon.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	smss.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\EHE4I2Y.com	lsass.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\MRD8W8U.exe	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	winlogon.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	system.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	system.exe
File opened for modification	C:\Windows\lsass.exe	lsass.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	lsass.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\cypreg.dll	system.exe
File opened for modification	C:\Windows\HKU4E6K.exe	smss.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\EHE4I2Y.com	smss.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe	system.exe
File opened for modification	C:\Windows\MRD8W8U.exe	system.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\NFL3V0E.exe	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
File opened for modification	C:\Windows\lsass.exe	service.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	service.exe
File opened for modification	C:\Windows\lsass.exe	winlogon.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd	lsass.exe
File opened for modification	C:\Windows\HKU4E6K.exe	lsass.exe
File opened for modification	C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\NFL3V0E.exe	winlogon.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	lsass.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\cypreg.dll	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeBackupPrivilege	1480	system.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
4928	service.exe
4988	smss.exe
2416	winlogon.exe
1480	system.exe
2532	lsass.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4928	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	81
PID 4108 wrote to memory of 4928	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	81
PID 4108 wrote to memory of 4928	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	81
PID 4108 wrote to memory of 4988	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	82
PID 4108 wrote to memory of 4988	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	82
PID 4108 wrote to memory of 4988	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	82
PID 4108 wrote to memory of 1480	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	83
PID 4108 wrote to memory of 1480	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	83
PID 4108 wrote to memory of 1480	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	83
PID 4108 wrote to memory of 2416	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	84
PID 4108 wrote to memory of 2416	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	84
PID 4108 wrote to memory of 2416	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	84
PID 4108 wrote to memory of 2532	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	85
PID 4108 wrote to memory of 2532	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	85
PID 4108 wrote to memory of 2532	4108	0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe	85

C:\Users\Admin\AppData\Local\Temp\0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe
"C:\Users\Admin\AppData\Local\Temp\0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe
  "C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4928
- C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe
  "C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4988
- C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
  "C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Sets file execution options in registry
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1480
- C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe
  "C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2416
- C:\Windows\lsass.exe
  "C:\Windows\lsass.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies system executable filetype association
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Executes dropped EXE
  - Sets file execution options in registry
  - Checks computer location settings
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\EHE4I2Y.com

Filesize
311KB

MD5
616eca6ee233e6569879b325a07cd071

SHA1
c4739385774ecc46587d636f5f0a4db44ec9fe1b

SHA256
0d7b235be32e3810e49bdedfc066c67e034c444aca76000a56a1434d0f8a9352

SHA512
acbfe45d77d769ca100a273876f8b70267d6a1711c62bfd66103ca50f43717e4d308336ba9a43d668a200a5227fa4c025c62be1e53443ae542c3c06b12c2c887

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\EHE4I2Y.com

Filesize
311KB

MD5
d35f39bd5b094d34250fd2365e2a5d74

SHA1
46f4bd09882d00017881174424af5a7e9e456828

SHA256
6a96efe1ef1758f88601caffc14e009d5fe776b80e0b0b9f89a04d7a7d7cab6f

SHA512
f051a4b436fca1ca7c43dd134d97b9e1b414e1c7b562e93c48c99b2c0b184fd9b620efb0c4d62d0f33f82ade3e472f6393428b6688936851acffa590d8c13d4e

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\EHE4I2Y.com

Filesize
311KB

MD5
d35f39bd5b094d34250fd2365e2a5d74

SHA1
46f4bd09882d00017881174424af5a7e9e456828

SHA256
6a96efe1ef1758f88601caffc14e009d5fe776b80e0b0b9f89a04d7a7d7cab6f

SHA512
f051a4b436fca1ca7c43dd134d97b9e1b414e1c7b562e93c48c99b2c0b184fd9b620efb0c4d62d0f33f82ade3e472f6393428b6688936851acffa590d8c13d4e

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\EHE4I2Y.com

Filesize
311KB

MD5
bce7fc1411adb5f621364835f79ff435

SHA1
af6519b45c1de0f60cfa0df7f4dcdc8e0200ceec

SHA256
045b83fb9bb5f151030ee6cadc8909257cad6a66fa7fb0d2077c6d868d97033a

SHA512
8be5438c740facf5144bcf8e44552238e2e3fc9d1ba7c2d081493a6ebf50c13d1fc53b4d8fe63c29c5972ece442a6d24a87c199b0591fbe860dc25859d471f53

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\NFL3V0E.exe

Filesize
311KB

MD5
9cb192648d7a58df0bbcb8dd0804771a

SHA1
c032bab67b5c573f5081275a242f9fa14b2faeae

SHA256
37fb88999fa68a997ee2a12193e2dff63b15239506756e1897a7c43e3007cd65

SHA512
c1f1377280f77a15a32ab96a064a2dd278c2cc0db55372f3fcf671ea3b4643dc2fb5dcb8bfa6572c1f123eac4527236715e5011187f86e7f1ba49e6233fe8909

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\NFL3V0E.exe

Filesize
311KB

MD5
e3b27a1c2c97d0227a8ee24ad351c3cc

SHA1
1f3c159bfdb5b83b074a82000223d351b348276a

SHA256
fbe06c8c3b7380dd99d256ad68deb07947dad6948cd0f8c0e8ff028bbda36443

SHA512
9f9ffff4fdad91608a1e4a7e43eada7c80fbff3eb566017ad6b1cf0ce1ad122c111aca848eb4b4ff8111e8b66ec5fe3cafabbdda7a87c166b2e6dd122dcd0b8e

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\NFL3V0E.exe

Filesize
311KB

MD5
889459a574c0628494be76145c9c267a

SHA1
6bc7fce726e0793235212ac2c3f20e45caa7b489

SHA256
4901803bed0568936fe96918f0b912c3868d1fc64cc75f7004a41ddec679c6d2

SHA512
d80da65ac488c3ffb15be9492b75baceb6c6788416dc0e65898c393384ca8b2f87a59b45daa03f2286ef3c8f58462e4d94e04ad0895c8aae99458b72ca817be9

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\NFL3V0E.exe

Filesize
311KB

MD5
e3b27a1c2c97d0227a8ee24ad351c3cc

SHA1
1f3c159bfdb5b83b074a82000223d351b348276a

SHA256
fbe06c8c3b7380dd99d256ad68deb07947dad6948cd0f8c0e8ff028bbda36443

SHA512
9f9ffff4fdad91608a1e4a7e43eada7c80fbff3eb566017ad6b1cf0ce1ad122c111aca848eb4b4ff8111e8b66ec5fe3cafabbdda7a87c166b2e6dd122dcd0b8e

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
311KB

MD5
033876631028cf4b50fd00e6f3672a2c

SHA1
929db944d6e32aed90acc1019c15fe1079650ca4

SHA256
8d629a1c433b5c0e978374793f4f0716741c94f1d892f115b328054195d960a6

SHA512
372b1949b314a4d7700a872bc417489a0fe07607db174b1d09b9da1a2a737a86385beb684c6ec083a36ee6ed549331accee13220b36cc8b78eaa7663f2e623cb

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
311KB

MD5
736f5a91a51ae7be9be7a981727040e9

SHA1
c138040425a226ceb04ead7fed2506f9376d43aa

SHA256
b74a147e79ed03ea17c4fa756a71480cbee74fd9f053c9d7230985505418333a

SHA512
aa36193a8ab27efabbfd8b0ffafb5002068bbd4d79766f69888034b8d7e90721ddbb79b6bae5079281e13abbd5895b294e3b6066fb503e5735376ea297bd221f

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
311KB

MD5
c20a163d81ce86198c4c49de457f6de5

SHA1
e2bc538f24aadceb606bedc794eee984e3fa5fb4

SHA256
b16ba804137a28a20071208dc5eff4b2111f1bd7265ff08f447f3f049e85ab1f

SHA512
74260d7f67342adb3017156ed68f5d588472a7a58efce86cbb5a78af6a013af38e472a200b22ba831a37451b5d0609ee7a02bd37ecba75128e7cd194aadf76d3

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\regedit.cmd

Filesize
311KB

MD5
616eca6ee233e6569879b325a07cd071

SHA1
c4739385774ecc46587d636f5f0a4db44ec9fe1b

SHA256
0d7b235be32e3810e49bdedfc066c67e034c444aca76000a56a1434d0f8a9352

SHA512
acbfe45d77d769ca100a273876f8b70267d6a1711c62bfd66103ca50f43717e4d308336ba9a43d668a200a5227fa4c025c62be1e53443ae542c3c06b12c2c887

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe

Filesize
311KB

MD5
394702a63eeef2966134eb5c099a3066

SHA1
6ec9c3d7c65022765bbd594573053e649ab3cf09

SHA256
d41cbcb0a9376a0bf718043057d70899d9cb9faebd10406eee9bb6ce71941ded

SHA512
15c7ec8cfbf4893578b250a834ed1ead7395394eb5eaa253a13eb166e04d2a0c34addd974bef5588813969160ba3f8e00762c75ccf2b1d843ed9be67de8d741f

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\service.exe

Filesize
311KB

MD5
394702a63eeef2966134eb5c099a3066

SHA1
6ec9c3d7c65022765bbd594573053e649ab3cf09

SHA256
d41cbcb0a9376a0bf718043057d70899d9cb9faebd10406eee9bb6ce71941ded

SHA512
15c7ec8cfbf4893578b250a834ed1ead7395394eb5eaa253a13eb166e04d2a0c34addd974bef5588813969160ba3f8e00762c75ccf2b1d843ed9be67de8d741f

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe

Filesize
311KB

MD5
b6f2d7c6e6b2d4c57949184c4c845a81

SHA1
b999580151a705a09f1d5390c99aa7f4fa439fae

SHA256
b0345522bb1fcb407bf20c34c58e446dd85457996133cb72bf19a1e24855b72c

SHA512
c42dfbd6da922f73a38984202879a758d826204a1ca6eed650b80d0d7a62eda861195c36a5c763f797a0252d5811ac0aec4a5e558bbd4a00bb13fcb6be3a9879

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\smss.exe

Filesize
311KB

MD5
b6f2d7c6e6b2d4c57949184c4c845a81

SHA1
b999580151a705a09f1d5390c99aa7f4fa439fae

SHA256
b0345522bb1fcb407bf20c34c58e446dd85457996133cb72bf19a1e24855b72c

SHA512
c42dfbd6da922f73a38984202879a758d826204a1ca6eed650b80d0d7a62eda861195c36a5c763f797a0252d5811ac0aec4a5e558bbd4a00bb13fcb6be3a9879

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe

Filesize
311KB

MD5
ae818789e882bfcf593407f2cf2644de

SHA1
6d796bf7662bf1ce0eae093f89c2405d0c2ed800

SHA256
0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984

SHA512
19363bb8a1c3dfbd1913517801bf1ce5655a8d6d3bafde8f2877cb6f6a7453d33e7dca0f437adedd294c1e7075fe70e53afd0a8c200775bf669b3f0aaf86062a

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe

Filesize
311KB

MD5
ae818789e882bfcf593407f2cf2644de

SHA1
6d796bf7662bf1ce0eae093f89c2405d0c2ed800

SHA256
0343a5ac71dee60f179ed1c1ba1a1107d4956c7aeb6ea9f2dce2ce41443d6984

SHA512
19363bb8a1c3dfbd1913517801bf1ce5655a8d6d3bafde8f2877cb6f6a7453d33e7dca0f437adedd294c1e7075fe70e53afd0a8c200775bf669b3f0aaf86062a

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe

Filesize
311KB

MD5
bce7fc1411adb5f621364835f79ff435

SHA1
af6519b45c1de0f60cfa0df7f4dcdc8e0200ceec

SHA256
045b83fb9bb5f151030ee6cadc8909257cad6a66fa7fb0d2077c6d868d97033a

SHA512
8be5438c740facf5144bcf8e44552238e2e3fc9d1ba7c2d081493a6ebf50c13d1fc53b4d8fe63c29c5972ece442a6d24a87c199b0591fbe860dc25859d471f53

Download Submit
C:\Windows\EJP0Q3E.{645FF040-5081-101B-9F08-00AA002F954E}\winlogon.exe

Filesize
311KB

MD5
bce7fc1411adb5f621364835f79ff435

SHA1
af6519b45c1de0f60cfa0df7f4dcdc8e0200ceec

SHA256
045b83fb9bb5f151030ee6cadc8909257cad6a66fa7fb0d2077c6d868d97033a

SHA512
8be5438c740facf5144bcf8e44552238e2e3fc9d1ba7c2d081493a6ebf50c13d1fc53b4d8fe63c29c5972ece442a6d24a87c199b0591fbe860dc25859d471f53

Download Submit
C:\Windows\HKU4E6K.exe

Filesize
311KB

MD5
7b728f4c55614bb05919e21ce28c174f

SHA1
78f88ebc4fb55dc68f93c7b502b3368bd1d4e458

SHA256
96e9f02803ec3afb6966abdb96c8a215a09f4e2a687bfa0af96c9b1c7e955d0b

SHA512
72c8cdb36d17ea91dc690cb917d4ff1c482a1156a57b8cfa8aabbac05aee9f48738005bddeb66e9dc277b5243526b6fe0a00fa71844348a03678ca96a2f77285

Download Submit
C:\Windows\HKU4E6K.exe

Filesize
311KB

MD5
033876631028cf4b50fd00e6f3672a2c

SHA1
929db944d6e32aed90acc1019c15fe1079650ca4

SHA256
8d629a1c433b5c0e978374793f4f0716741c94f1d892f115b328054195d960a6

SHA512
372b1949b314a4d7700a872bc417489a0fe07607db174b1d09b9da1a2a737a86385beb684c6ec083a36ee6ed549331accee13220b36cc8b78eaa7663f2e623cb

Download Submit
C:\Windows\HKU4E6K.exe

Filesize
311KB

MD5
033876631028cf4b50fd00e6f3672a2c

SHA1
929db944d6e32aed90acc1019c15fe1079650ca4

SHA256
8d629a1c433b5c0e978374793f4f0716741c94f1d892f115b328054195d960a6

SHA512
372b1949b314a4d7700a872bc417489a0fe07607db174b1d09b9da1a2a737a86385beb684c6ec083a36ee6ed549331accee13220b36cc8b78eaa7663f2e623cb

Download Submit
C:\Windows\HKU4E6K.exe

Filesize
311KB

MD5
ac5a7df8ca4527e1665fd19264334b73

SHA1
f5d5cb885a3f8b1d6aa202f7fe8a661a74a8ec4a

SHA256
15f0a452aeebe65ce908c7c0b86de596001d851ec6ae497502553f90cc568023

SHA512
b768d546db0febb8efbe8fd19853c8ac580d48843c938fe93207925ad660545b54d4a9828cd0982a673f65024f2179efc3f2ca9856ccfff19cbd3f52be35e4d3

Download Submit
C:\Windows\HKU4E6K.exe

Filesize
311KB

MD5
ac5a7df8ca4527e1665fd19264334b73

SHA1
f5d5cb885a3f8b1d6aa202f7fe8a661a74a8ec4a

SHA256
15f0a452aeebe65ce908c7c0b86de596001d851ec6ae497502553f90cc568023

SHA512
b768d546db0febb8efbe8fd19853c8ac580d48843c938fe93207925ad660545b54d4a9828cd0982a673f65024f2179efc3f2ca9856ccfff19cbd3f52be35e4d3

Download Submit
C:\Windows\MRD8W8U.exe

Filesize
311KB

MD5
70851e997eba4bc2b721b6e5769eb9d1

SHA1
388739babd5853d1ed4910c8bc4d65e4c238a1a8

SHA256
e134a1de22a58333908001a195e9a5fa01141a9b5ab627835096536ab2b55d4e

SHA512
e975db1a999864b1fa652862f35aa7cb4effd6b71291fd514d5ae6e49a5b5819cfdd2e7b7faf6f25227a690d8bd7830eac2bd51a5e8a0b16bb8a3c0006ee2369

Download Submit
C:\Windows\MRD8W8U.exe

Filesize
311KB

MD5
237bada8df1d4c891b883552695cd9c0

SHA1
cf55788bbd5a0ce8f5a9ca151e4d489635bd0779

SHA256
c175421cc17163908929e1a82872401192f032e333c1edcd2f0be1de1e642d78

SHA512
70c9bbce4055387a04bb29a4473630e5ec906a9109f8a05058b5234803f1cfd383d16ae24acff5a4d93b2d63a14bbc371d843571d926495b8a6401fb641033a1

Download Submit
C:\Windows\MRD8W8U.exe

Filesize
311KB

MD5
237bada8df1d4c891b883552695cd9c0

SHA1
cf55788bbd5a0ce8f5a9ca151e4d489635bd0779

SHA256
c175421cc17163908929e1a82872401192f032e333c1edcd2f0be1de1e642d78

SHA512
70c9bbce4055387a04bb29a4473630e5ec906a9109f8a05058b5234803f1cfd383d16ae24acff5a4d93b2d63a14bbc371d843571d926495b8a6401fb641033a1

Download Submit
C:\Windows\MRD8W8U.exe

Filesize
311KB

MD5
9cb192648d7a58df0bbcb8dd0804771a

SHA1
c032bab67b5c573f5081275a242f9fa14b2faeae

SHA256
37fb88999fa68a997ee2a12193e2dff63b15239506756e1897a7c43e3007cd65

SHA512
c1f1377280f77a15a32ab96a064a2dd278c2cc0db55372f3fcf671ea3b4643dc2fb5dcb8bfa6572c1f123eac4527236715e5011187f86e7f1ba49e6233fe8909

Download Submit
C:\Windows\SysWOW64\IXC5F6O\QLK0R5M.cmd

Filesize
311KB

MD5
b6f2d7c6e6b2d4c57949184c4c845a81

SHA1
b999580151a705a09f1d5390c99aa7f4fa439fae

SHA256
b0345522bb1fcb407bf20c34c58e446dd85457996133cb72bf19a1e24855b72c

SHA512
c42dfbd6da922f73a38984202879a758d826204a1ca6eed650b80d0d7a62eda861195c36a5c763f797a0252d5811ac0aec4a5e558bbd4a00bb13fcb6be3a9879

Download Submit
C:\Windows\SysWOW64\IXC5F6O\QLK0R5M.cmd

Filesize
311KB

MD5
ac5a7df8ca4527e1665fd19264334b73

SHA1
f5d5cb885a3f8b1d6aa202f7fe8a661a74a8ec4a

SHA256
15f0a452aeebe65ce908c7c0b86de596001d851ec6ae497502553f90cc568023

SHA512
b768d546db0febb8efbe8fd19853c8ac580d48843c938fe93207925ad660545b54d4a9828cd0982a673f65024f2179efc3f2ca9856ccfff19cbd3f52be35e4d3

Download Submit
C:\Windows\SysWOW64\IXC5F6O\QLK0R5M.cmd

Filesize
311KB

MD5
ca58d19ce34b4a4b1bec6fe41fe837e8

SHA1
4aaf05f2405fb2a6e23394c8b39434b4936ff105

SHA256
28e8cdb373ab8745aece9cabe1a86a468cabee97c2dc93a5a267dbd2f288b575

SHA512
1671da912e9dc45ed208704b95989355bce5a24f19e7f599434bd207403b485fe55c6478a748c0d67c51ceef6755e589e0ebfaf86a1efeee8b2e2d98a501dc20

Download Submit
C:\Windows\SysWOW64\IXC5F6O\QLK0R5M.cmd

Filesize
311KB

MD5
736f5a91a51ae7be9be7a981727040e9

SHA1
c138040425a226ceb04ead7fed2506f9376d43aa

SHA256
b74a147e79ed03ea17c4fa756a71480cbee74fd9f053c9d7230985505418333a

SHA512
aa36193a8ab27efabbfd8b0ffafb5002068bbd4d79766f69888034b8d7e90721ddbb79b6bae5079281e13abbd5895b294e3b6066fb503e5735376ea297bd221f

Download Submit
C:\Windows\SysWOW64\QLK0R5MMRD8W8U.exe

Filesize
311KB

MD5
394702a63eeef2966134eb5c099a3066

SHA1
6ec9c3d7c65022765bbd594573053e649ab3cf09

SHA256
d41cbcb0a9376a0bf718043057d70899d9cb9faebd10406eee9bb6ce71941ded

SHA512
15c7ec8cfbf4893578b250a834ed1ead7395394eb5eaa253a13eb166e04d2a0c34addd974bef5588813969160ba3f8e00762c75ccf2b1d843ed9be67de8d741f

Download Submit
C:\Windows\SysWOW64\QLK0R5MMRD8W8U.exe

Filesize
311KB

MD5
64890b76e1a044fd73a1d8ed7343bc16

SHA1
62e4178602003af7933e779da682173ef747531a

SHA256
5c804cbf51c5169bec4fd65268a17a30290507f6059357ce743fcf9371be8999

SHA512
ff39dfbe4e401faa7becd92e7e69f75f43028b4ae88b29a6f10af744384be4e4e255521a6bbdb5897fd5ec307d03a19ae0e4a0b681c71a8cd126686c1f6c5a09

Download Submit
C:\Windows\SysWOW64\QLK0R5MMRD8W8U.exe

Filesize
311KB

MD5
64890b76e1a044fd73a1d8ed7343bc16

SHA1
62e4178602003af7933e779da682173ef747531a

SHA256
5c804cbf51c5169bec4fd65268a17a30290507f6059357ce743fcf9371be8999

SHA512
ff39dfbe4e401faa7becd92e7e69f75f43028b4ae88b29a6f10af744384be4e4e255521a6bbdb5897fd5ec307d03a19ae0e4a0b681c71a8cd126686c1f6c5a09

Download Submit
C:\Windows\SysWOW64\QLK0R5MMRD8W8U.exe

Filesize
311KB

MD5
7e5a3e1ce48dfff325d60932cd576a77

SHA1
1033507564335f7630803455cae44a66c69add29

SHA256
6d1178224e4eb8180035f6dd4a1ce353b9cd68b56e79b0d00a2b06b2ae0e830c

SHA512
ea7bec9cd5a068127bb4fe3aab8a1dbca9d64becefbf1b17979863907c70210bfda6da4be563b30c7e25ef6dff8bd17a9643346af14aa8d985608f9f6fbf989e

Download Submit
C:\Windows\SysWOW64\WVC4H3R.exe

Filesize
311KB

MD5
237bada8df1d4c891b883552695cd9c0

SHA1
cf55788bbd5a0ce8f5a9ca151e4d489635bd0779

SHA256
c175421cc17163908929e1a82872401192f032e333c1edcd2f0be1de1e642d78

SHA512
70c9bbce4055387a04bb29a4473630e5ec906a9109f8a05058b5234803f1cfd383d16ae24acff5a4d93b2d63a14bbc371d843571d926495b8a6401fb641033a1

Download Submit
C:\Windows\SysWOW64\WVC4H3R.exe

Filesize
311KB

MD5
237bada8df1d4c891b883552695cd9c0

SHA1
cf55788bbd5a0ce8f5a9ca151e4d489635bd0779

SHA256
c175421cc17163908929e1a82872401192f032e333c1edcd2f0be1de1e642d78

SHA512
70c9bbce4055387a04bb29a4473630e5ec906a9109f8a05058b5234803f1cfd383d16ae24acff5a4d93b2d63a14bbc371d843571d926495b8a6401fb641033a1

Download Submit
C:\Windows\SysWOW64\WVC4H3R.exe

Filesize
311KB

MD5
1ed982201f86d9f816f73304424967ff

SHA1
364e1ab86e0a6e01497f40a2d69b741ffee4965b

SHA256
3ae8b7fe8433a5f853863855ccc0e2d0462391642aca5663793294f22ae0aae3

SHA512
27cbeb28053399ab4defb2f4267e0654a992b993194bac38c0ff6563f060707d9bf948082fd01b4842c7ddbc1b1e19b88f79b9309a47465f92ee53ed772821a4

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
127B

MD5
2f97418d8df40649e8b8945f7a51cf41

SHA1
84676e36d28a10525ab8cf084a483a118846b730

SHA256
9b85f5bd72206dae1bb4d4daa7c0ae52196c4b1d92973753ae89021238a0ac5f

SHA512
68b95cd79b2f187ed325f8b5117d11904e7404405935dc21487f0137902a88e3142b65d5c54bdc0560d6a7e7d8748752f6972535f8999b9696ab113647d62e31

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
5fe7bfe4edf79fb3cc5c8f1b78f15cc6

SHA1
f4298404f2401a41691fc7b7dca9309004f421a8

SHA256
d34b12066db8b1566ef6b7a30e7fd710b83a6f51c81b118b09fc6f88cb8236fb

SHA512
b5a474fa54540f0458dd2f92254abcaf30f06c2b61878847db407744fb0ea7c4514b2c8f78722a67ebda1ebd8ff96e82a9e3d8f547988767eefecf0746e0c5aa

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
5fe7bfe4edf79fb3cc5c8f1b78f15cc6

SHA1
f4298404f2401a41691fc7b7dca9309004f421a8

SHA256
d34b12066db8b1566ef6b7a30e7fd710b83a6f51c81b118b09fc6f88cb8236fb

SHA512
b5a474fa54540f0458dd2f92254abcaf30f06c2b61878847db407744fb0ea7c4514b2c8f78722a67ebda1ebd8ff96e82a9e3d8f547988767eefecf0746e0c5aa

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
143a309d8d59ee6bfce708236c2f639f

SHA1
c940d4ac73e516517a237efa55d76ebbb741868e

SHA256
5fdbe88a4bc1b80f513e0d64cbb68bb477d486687032de7d86ddc0cea00cade4

SHA512
6652aeeac6c8ffa5f9e51773c0191bcea1d138e384e909e02d8c2a20fbd0dfb56555a26b2725496a49709b99a66d4c105c20cbcba7c5dab2b869ceaaff2a566e

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
26f2877dc2b09e2739d77e92503c4ea4

SHA1
d5bf6af509884d16e6a11a5a3a3f57aa2de16d3c

SHA256
423cd8275afe8a3fec35335df91322e6640822ff7e25445451cb924c334479e8

SHA512
095f89ae79a3c5012c117c9ab07c1932b86ebf171efdb9ad7dd0709d3a8d48b6b9b2e74a1b1a0ccf96ac9ef415965b473dab2864cf3192149986342549511722

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
26f2877dc2b09e2739d77e92503c4ea4

SHA1
d5bf6af509884d16e6a11a5a3a3f57aa2de16d3c

SHA256
423cd8275afe8a3fec35335df91322e6640822ff7e25445451cb924c334479e8

SHA512
095f89ae79a3c5012c117c9ab07c1932b86ebf171efdb9ad7dd0709d3a8d48b6b9b2e74a1b1a0ccf96ac9ef415965b473dab2864cf3192149986342549511722

Download Submit
C:\Windows\cypreg.dll

Filesize
361KB

MD5
c5c7392dc94c13ef23f98cb3729bf711

SHA1
404d820f4b62462eb932275e3b58a1be42896e7c

SHA256
b73e8cf25db9683d28cca18b3db91fefa1f8c1f6c06bcb0ff1855c9ca3e498f3

SHA512
7153bfab3578b60732b0f86fef10bbb722e978124b1d71c58373e8dfbf3a989983314ab63b40ef99722c42d12da2a28955c770d0f1223993145fd9246ff0cc43

Download Submit
C:\Windows\lsass.exe

Filesize
311KB

MD5
9cb192648d7a58df0bbcb8dd0804771a

SHA1
c032bab67b5c573f5081275a242f9fa14b2faeae

SHA256
37fb88999fa68a997ee2a12193e2dff63b15239506756e1897a7c43e3007cd65

SHA512
c1f1377280f77a15a32ab96a064a2dd278c2cc0db55372f3fcf671ea3b4643dc2fb5dcb8bfa6572c1f123eac4527236715e5011187f86e7f1ba49e6233fe8909

Download Submit
C:\Windows\lsass.exe

Filesize
311KB

MD5
9cb192648d7a58df0bbcb8dd0804771a

SHA1
c032bab67b5c573f5081275a242f9fa14b2faeae

SHA256
37fb88999fa68a997ee2a12193e2dff63b15239506756e1897a7c43e3007cd65

SHA512
c1f1377280f77a15a32ab96a064a2dd278c2cc0db55372f3fcf671ea3b4643dc2fb5dcb8bfa6572c1f123eac4527236715e5011187f86e7f1ba49e6233fe8909

Download Submit
C:\Windows\lsass.exe

Filesize
311KB

MD5
9cb192648d7a58df0bbcb8dd0804771a

SHA1
c032bab67b5c573f5081275a242f9fa14b2faeae

SHA256
37fb88999fa68a997ee2a12193e2dff63b15239506756e1897a7c43e3007cd65

SHA512
c1f1377280f77a15a32ab96a064a2dd278c2cc0db55372f3fcf671ea3b4643dc2fb5dcb8bfa6572c1f123eac4527236715e5011187f86e7f1ba49e6233fe8909

Download Submit
C:\Windows\lsass.exe

Filesize
311KB

MD5
033876631028cf4b50fd00e6f3672a2c

SHA1
929db944d6e32aed90acc1019c15fe1079650ca4

SHA256
8d629a1c433b5c0e978374793f4f0716741c94f1d892f115b328054195d960a6

SHA512
372b1949b314a4d7700a872bc417489a0fe07607db174b1d09b9da1a2a737a86385beb684c6ec083a36ee6ed549331accee13220b36cc8b78eaa7663f2e623cb

Download Submit
C:\Windows\lsass.exe

Filesize
311KB

MD5
033876631028cf4b50fd00e6f3672a2c

SHA1
929db944d6e32aed90acc1019c15fe1079650ca4

SHA256
8d629a1c433b5c0e978374793f4f0716741c94f1d892f115b328054195d960a6

SHA512
372b1949b314a4d7700a872bc417489a0fe07607db174b1d09b9da1a2a737a86385beb684c6ec083a36ee6ed549331accee13220b36cc8b78eaa7663f2e623cb

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
c55534452c57efa04f4109310f71ccca

SHA1
b97a3d9e2c1ad9314562b7d0d77b2a4b34e77d61

SHA256
4cbbe69bcd0a2debae6a584e1fa49f8d4a27f90d9cd364255bbbd930ca0a38bc

SHA512
ad324f1f1bfde9c9b6057d5526ae62155b3b897d27225ed74fdb867a2c6d5f21cebfb63e3dc68bd807993b0f4c72fb3ce880696b9c3358b3b982204d60c7161a

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
220cd5b36a14cfc83715839698aeaaa8

SHA1
e2957eb14abffa17ad61b7555221803444f92288

SHA256
eb319cc5c5e432b3f111b185fa12e1410b43d90b81b4bd8d7f007c860256b4b1

SHA512
65f4473e6f2f6af2c9197fb25955b58f1f2504b3cf364e6e6f41b9e1ba9fb6a80613797a0b4b24b41ce88b1f2afbb52cc3efcc5a362c4f54f2beb745028a9441

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
9a9f3b124d45dc37a7f7ea0d56a2ce77

SHA1
0040ee250be20db1c54f20538422950f967a999c

SHA256
18109fcda7b887d3462aea4c31baf1772ae0926ff1b13835f9ad7c24c3225b32

SHA512
b20973d37eb109537c5889f8deb5b0da3ff3d89d11e2ce8bad0ed7b8627a539e22f9579c8913e51f24891892be9aff62b4ba99b9f51de717136c565aa21e4eaa

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
9a9f3b124d45dc37a7f7ea0d56a2ce77

SHA1
0040ee250be20db1c54f20538422950f967a999c

SHA256
18109fcda7b887d3462aea4c31baf1772ae0926ff1b13835f9ad7c24c3225b32

SHA512
b20973d37eb109537c5889f8deb5b0da3ff3d89d11e2ce8bad0ed7b8627a539e22f9579c8913e51f24891892be9aff62b4ba99b9f51de717136c565aa21e4eaa

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.4MB

MD5
af5cd0a597291a0405bea4965ad40c8a

SHA1
ea3fb8aa51b06ad46b016b23ba74339373ce3859

SHA256
e215d35c0ad0648208ac3be6a0e93388d0975ebc6130c9178567bb16a1a0d790

SHA512
2f0cbb396916b3da132ce8771600e060c761b64400bad1e81c6b8b4533af45c16f1fb9a480feab44c2fff0991ad514f0ba9051f091651c2d2cd5d5c20a15dc5f

Download Submit
memory/1480-226-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/1480-157-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/1480-224-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/1480-222-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2416-158-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2416-223-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2532-219-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2532-225-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4108-218-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4108-132-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4928-220-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4928-155-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4988-221-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/4988-156-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads