Analysis
- max time kernel
172s - max time network
181s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
21/10/2022, 02:49
Static task
static1
Behavioral task
behavioral1
Sample
b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
Resource
win7-20220812-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
16 signatures
150 seconds
General
- Target b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe
- Size 149KB
- Sample221021-da5yqshcd2
- SHA256 b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af
- MD5 4f47c6f97a61e28c251ccba05c7c9b86
- SHA1 4661d019647d28f9a7687f46ab9dfb25f52cc77c
- SHA512 225c0a388317a7f08d01af3fb974dce7d079176292224b6cda26fac5bd90910284cdf92a45eaf7f8473cea6caba5667b8d6d9bdf14dc57429b199105bcb6690a
- SSDEEP 3072:JTJK5SKcSNFcmTJK5cjMWoe0c8TilDcq15:JTJrRyWmTJh5yc8TO915
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" Executioner.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" Executioner.exe - Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Executioner = "C:\\Windows\\Executioner.exe" Executioner.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Executioner.exe - Disables Task Manager via registry modification
- Executes dropped EXE 2 IoCs
pid Process 3800 Executioner.exe 4168 Executioner.exe - Sets file execution options in registry 2 TTPs 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "rstrui.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "msconfig.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "taskmgr.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "regedit.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmsgs.exe = "C:\\Windows\\Executioner.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedt32.exe = "C:\\Windows\\Executioner.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe = "C:\\Windows\\Executioner.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "calc.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "mspaint.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "wscript.exe" Executioner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe = "C:\\Windows\\Executioner.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe = "C:\\Windows\\Executioner.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "msmsgs.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe = "C:\\Windows\\Executioner.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options = "regedt32.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\calc.exe = "C:\\Windows\\Executioner.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe = "C:\\Windows\\Executioner.exe" Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe = "C:\\Windows\\Executioner.exe" Executioner.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Executioner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Executioner = "C:\\Windows\\Executioner.exe" Executioner.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\Dakila.nfo b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Windows\SysWOW64\Dakila.nfo b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Windows\SysWOW64\Dakila.nfo Executioner.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\2.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\MotionController_Hero.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Concrete.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\music_offline_demo_page2.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\8.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\19.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-2.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\video_offline_demo_page1.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\10.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\31.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_01.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_02.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Sand.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Assets\music_offline_demo_page1.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\31.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\75.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_neutral_split.scale-200_8wekyb3d8bbwe\Win10\MicrosoftSolitaireSmallTile.scale-200.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_04.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\FirstRunMailBlurred.layoutdir-RTL.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-1.exe Executioner.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\avatar.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\27.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\7.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\Stickers\Thumbnails\Sticker_Icon_Wood.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.JPG Executioner.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_48.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_03.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Tracing.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg2.exe Executioner.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\javascript_poster.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\39.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\3.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_Safety_Objects.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Resources\RetailDemo\data\en-us\2.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\3.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\40.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\12.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\0.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\7.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\9.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_04.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AboutAdsGenericBackgroundImage.exe Executioner.exe File opened for modification C:\Program Files\Windows Media Player\Media Renderer\DMR_120.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg1a.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\91.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_05.exe Executioner.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\accessibility_poster.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\82.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\4.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\29.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\12.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\13.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\423x173\75.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\MicrosoftSolitaireLargeTile.scale-100.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_02.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\13.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\27.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\ThankYou\GenericEnglish-3.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\Assets\Background_RoomTracing_Success.exe Executioner.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\bg1a.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\AboutAdsCoreBackgroundImage.exe Executioner.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\Executioner.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File opened for modification C:\Windows\Executioner.exe b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe File created C:\Windows\Executioner.exe Executioner.exe File opened for modification C:\Windows\Executioner.exe Executioner.exe File opened for modification C:\Windows\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.jpg b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3492 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4504 b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe 3800 Executioner.exe 4168 Executioner.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4504 wrote to memory of 3800 4504 b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe 81 PID 4504 wrote to memory of 3800 4504 b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe 81 PID 4504 wrote to memory of 3800 4504 b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe 81 PID 3800 wrote to memory of 4168 3800 Executioner.exe 82 PID 3800 wrote to memory of 4168 3800 Executioner.exe 82 PID 3800 wrote to memory of 4168 3800 Executioner.exe 82 PID 4504 wrote to memory of 3492 4504 b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe 83 PID 4504 wrote to memory of 3492 4504 b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe 83 PID 4504 wrote to memory of 3492 4504 b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe"C:\Users\Admin\AppData\Local\Temp\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4504 -
C:\Windows\Executioner.exeC:\Windows\Executioner.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Sets file execution options in registry
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Windows\Executioner.exeC:\Windows\Executioner.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4168
-
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Windows\System32\SHIMGVW.DLL,ImageView_Fullscreen C:\Windows\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.jpg2⤵
- Suspicious use of FindShellTrayWindow
PID:3492
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3764
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4572
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2068
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1932
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1156
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4768
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\images\avatar.exe
- Size 55KB
- SHA256 d1f3cdac6ca6a037c503bbcb06f2682e81f53f8757f8b1681a52a325dd4317df
- MD5 dcb28dcd069c6bdc1a014b25e4f2dacb
- SHA1 dcdc922afd40161179cbab409380eeb2409dcda6
- SHA512 978860b01b243c3079b4df981d7707981946217f4e97137e933d1a69567357c8e104903219529c5984487eaecb35d844268a89fdad68cadc6c3fd9c98379c7b2
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOp6:1HTJKqOS3aVSqznJ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\compare_poster.exe
- Size 79KB
- SHA256 ba7f75d0c3437e5ebc805c889b3a1d14d0828ee163cf7c87028c3a29a01ad753
- MD5 a770eba25991592533b5d7625a4098b7
- SHA1 f001e7b9446bf41776312241e343a8ea73334786
- SHA512 eab461bfa5473f8876204c25d38d46abbee0d8cf7c6a780d4836e7f95795a6145a2c13c470707642ff37b2b7076d2ca0a082fb3457701184d82e232457d7368e
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOkpaMd6G4r7x5hDM6kQfS53adFrQ87:1HTJKqOS3aVSqzn+MXYdjDMW1dGPCpg6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster.exe
- Size 81KB
- SHA256 6e77266307287e76ef974157fdef9f6ae2a1ef914120ecc3d1fd699bfe4d77b9
- MD5 eaa52a6e45a7eda452002aede4b99a05
- SHA1 0f98c5f710ce09d31f52c710806ba873983258d0
- SHA512 845780ebdaaf2885217a71beaaf885c1f8b286cc48a46ef43742c3526f4a97dc5577f00f260438304dac913c184daa1fb590fb4893909c7e6735e93a6c0919f1
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOjf7YapqDoCuVu/+++++++++hjF86r:1HTJKqOS3aVSqznODsMF81VYpcxKaLU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\index_poster.exe
- Size 107KB
- SHA256 4a60aa1d1706c0b449bf1c2750fd00ae608c5e92aef9ed0c38261217ebe613f0
- MD5 b87c58cc68d53c45558ab18e684fd32f
- SHA1 4dc61325d686a830e795f5bbac60e6d94ea7b145
- SHA512 dbff83bae375435adc97472c0a33f870c2e7e750445d59c50761f3e04933a9804cb17393631490d9bc34867721f94f8e208f8c4b3b7c6c8bfb1f763c67a13070
- SSDEEP 1536:1HTJKqOS3aVSqznMS6CTROuupZ1zUwjYudMYjnBcvpbl:JTJK5SKcSr5RAZ1zUwjYEBja7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\javascript_poster.exe
- Size 97KB
- SHA256 e168250a845e066aa795c70d0eab388e1f26142d6fbb1baac0b4cc514c211b28
- MD5 326afc5c88561966100c3a52662120d4
- SHA1 a88005669b9c341191f01a39b32dac144b16c904
- SHA512 02d1237c5bece52993bdc01e8ba1a69dd2c1a209a36df99cb91255425a822648b440b795e01bb53d3b8ad3190d84bcc7c0f98efdbe7cb9a04a3dcbf145313cfe
- SSDEEP 1536:1HTJKqOS3aVSqznY6JfYxO4Rw74Ax6POLAwHsp/r0vtjf/:JTJK5SKcSZcwjxDL5sYtr/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\measure_poster.exe
- Size 135KB
- SHA256 67e9a3e35e66f30ade3dde0477f6f6233a9d4c1115a5de48a8a5aadb90bc435f
- MD5 3333999d514e2c5282d2baf84464b441
- SHA1 b967001286471606f0a4cdf5b9380989f845699a
- SHA512 d402c25c13695ee850cc22a6a87ac331a2e4c37189ab065c2c95a157195f5c142dfa7b62990df8a3d1c16c003108566174987ecbd4aa5c2cf735851cd5bd8892
- SSDEEP 1536:1HTJKqOS3aVSqznR90pu3RbWJPtqdWpF5qEBbc9ikn0eYGqJPfHTPTDRcdlngHgY:JTJK5SKcSRGUmPtqdUyhn0eH2ggHgN2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\media_poster.exe
- Size 117KB
- SHA256 05b70c0b453c6989fb7a8342dbd782ffe2594aef91ad46caee56d192497b9e00
- MD5 ba5a5dde8bcd5538f95a14dc63d86e2f
- SHA1 5ecdd84f08b9be00c083f6c91ea4f9fb7c105198
- SHA512 bec7b8c4847e60ce33b1f1ac0347a70efd24153abd0094718b88b37e89e43ea556ca45d5f3420d6d9e49ca6ff4870419fffe01a2b79d351c752e907060fc0a2e
- SSDEEP 1536:1HTJKqOS3aVSqzn20IIsUNnZwcxheClAxARte6i70IVL61M2Q3Ev+amPspJ84/:JTJK5SKcStVYxuu1LOM2QU2hspJz
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\optimize_poster.exe
- Size 75KB
- SHA256 52be321249d565ec75a603cf4dbb35dcf8be03461600d2d1c5f6dd3d1dbfe9c4
- MD5 4358191d2de60cf00e957cb1ee8166d6
- SHA1 61bc932e0e052df685a89ade21f44dc169faf19e
- SHA512 ba826a7002fd698057dcaf70392876b3d415065f3334282667c528fb08a875ff4ee5bc268ba7408585fb1d3367c4d3aed979f48ad72c9ce134b0fd5567621949
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOR799pnSpdO9CRBlXiT4zrFF+rVZrX:1HTJKqOS3aVSqznIZ9JSTkqjY4zxF+fn
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\organize_poster.exe
- Size 120KB
- SHA256 3e0aedc0dd62cf20ea5a49d63abdfde4a5ca48abe38e9927c1c1d799b4475166
- MD5 73e5ddf65e5ce8fb4fe48fd57dacd350
- SHA1 d39c0e3d53dba67bbbe208ba64ecee2e21c08f59
- SHA512 cc9504c4a5f9974e4a6854c329e5678a51cb5a7dfa74972f7ec61cb23aef42ee1f1ca07d4e99e19da44df219e47a5e278d3986787ab7869545d06c6a7f3589c7
- SSDEEP 3072:JTJK5SKcSISXKH3edL7DyNmXBvnX2Wd5twwJUqyMI:JTJrR+L751Xnd5tww8MI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\protect_poster.exe
- Size 75KB
- SHA256 5df31a6bf0775d5ed0e09dc63f7ec942d1ff9b688e5ee43f37065d60065c13f6
- MD5 308e3f3eaed60a559164a1b2b6602196
- SHA1 ea29a20bbabe6f159de8488e97988a4709b57a33
- SHA512 3ca9de31237c77cf39e09a15b878920aec427a2b9b0871574f844ee62583b85d723dddf093104e9483bcf5efaee6415929808c1fa55e87c7035305cbebb61ca0
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOdenxgg9oP4K0Rxgsp3CoO+:1HTJKqOS3aVSqznaWxgguip33n
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\redact_poster.exe
- Size 79KB
- SHA256 986d93e0c190b396d5cfac955a13122f5e736934777f06e274e30809acf17273
- MD5 4aa0959f6b52380de49dbcf1692d700b
- SHA1 f615be14d007db0e59e70c1ba7880cfe03641ba3
- SHA512 158d24a2e468b07c97ce4ca01cb1c55c1e1ba02ab639a1fcf79530ed434652687db15194802870b5e403e601fc6e618e9530244d1ec3df2f99d05b048ab9b4d1
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOfmZVgijbuzB1Url+TBBbtW+3XJD0f:1HTJKqOS3aVSqzn0mfa1AUsG+1l
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\review_poster.exe
- Size 118KB
- SHA256 b4b1202d32c5b5fbe4596043940b6c914de871fda65cec80a4133c48f4a9c0dd
- MD5 531fcf030caf9c12a59d2c9a2efae533
- SHA1 b09d7fe912b312242e04ec5d0a4333287c5223a2
- SHA512 b947f0f300b39da7688f33668ec9f4e16fc90ff915e89165c889342a96fa78d25a5ae078a9f75d7508c49bf2f418f143c98aec273a96134e9cfbd64694f02d94
- SSDEEP 1536:1HTJKqOS3aVSqznlZGKLIF+Obag4o3Ogn6M+4ZgU8FEkuveQxup/:JTJK5SKcS3GSc+w4PgO4KnFvuvpG
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\scan_poster.exe
- Size 82KB
- SHA256 8c973d9052ea98a2591868fd367f957d376354743149c4a2c0ae1de206e0ae93
- MD5 7661efba8665c6e9dd1d741a3e84f02c
- SHA1 d42a47cfe9dae09efba30d669240245354158b68
- SHA512 c9d58f305fa5fed7409a4e22cbdb2f3cf7bb7593e08af5dbcf4686f0b3079ec5c24ca68fad907173fdb328e2b7ad0833c1d2bb2b49dd90520a484fe0b5325288
- SSDEEP 1536:1HTJKqOS3aVSqzneE/VWVesOl1kcjZSlJT66:JTJK5SKcSRtWXMyTl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.exe
- Size 55KB
- SHA256 732643b138058a9e78e4d470283af2982566f678a184b787552fbb6e211af9fc
- MD5 aa4a0ff6290d8223db6d04553b1bca55
- SHA1 c9587464635912ed24dd403e45154589aff8e6fe
- SHA512 20de29dcdfe091286667f69de21e30064140a3826c6b9505010f88771095240290640a8b880c9009ede8dc73d894f10f4a4b2e9563427c7d683d03826bb6db21
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOYoLcN9:1HTJKqOS3aVSqzn/p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.exe
- Size 55KB
- SHA256 732643b138058a9e78e4d470283af2982566f678a184b787552fbb6e211af9fc
- MD5 aa4a0ff6290d8223db6d04553b1bca55
- SHA1 c9587464635912ed24dd403e45154589aff8e6fe
- SHA512 20de29dcdfe091286667f69de21e30064140a3826c6b9505010f88771095240290640a8b880c9009ede8dc73d894f10f4a4b2e9563427c7d683d03826bb6db21
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOYoLcN9:1HTJKqOS3aVSqzn/p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.exe
- Size 53KB
- SHA256 fd040168f07b6aca2fc7d9dcf415a2ef9f8f3926dd308fceeb4ab8db8947382e
- MD5 3aa5d10b2cd74b643a7c5ba36433c6c8
- SHA1 7447e8367bf6f80bb85e8f1961f1823f251d3182
- SHA512 b8e87f125edccbdcb1a8c84734a98421f076f64f7dae8e9ac7b94091fa51500bcac55eefa1364f62518cae07d4edb3b1e6f779aad64f10909eb30001afadc0f8
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOiD:1HTJKqOS3aVSqzndD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.exe
- Size 53KB
- SHA256 fd040168f07b6aca2fc7d9dcf415a2ef9f8f3926dd308fceeb4ab8db8947382e
- MD5 3aa5d10b2cd74b643a7c5ba36433c6c8
- SHA1 7447e8367bf6f80bb85e8f1961f1823f251d3182
- SHA512 b8e87f125edccbdcb1a8c84734a98421f076f64f7dae8e9ac7b94091fa51500bcac55eefa1364f62518cae07d4edb3b1e6f779aad64f10909eb30001afadc0f8
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOiD:1HTJKqOS3aVSqzndD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.JPG
- Size 106KB
- SHA256 75163d32b70211076ae6a62cae9534f56e4edfd66b9c787b7a6c07cb709ca646
- MD5 1f84678fbf1b0cfe7e409efae3230177
- SHA1 cb4a4dc0ea3212e3792ed3974b1ed4996502c7d2
- SHA512 78e3a8b3940b458a01473f639487bd36e0690b6e41ca525a5f1178c2c32c3760232bb5d7e7601172591cc2ab82aa5342ef7c39de7808b26e0a1d3274762e7aa6
- SSDEEP 1536:1HTJKqOS3aVSqznL8HTJKqOS3aVSqznLk:JTJK5SKcSQTJK5SKcSA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.JPG
- Size 106KB
- SHA256 75163d32b70211076ae6a62cae9534f56e4edfd66b9c787b7a6c07cb709ca646
- MD5 1f84678fbf1b0cfe7e409efae3230177
- SHA1 cb4a4dc0ea3212e3792ed3974b1ed4996502c7d2
- SHA512 78e3a8b3940b458a01473f639487bd36e0690b6e41ca525a5f1178c2c32c3760232bb5d7e7601172591cc2ab82aa5342ef7c39de7808b26e0a1d3274762e7aa6
- SSDEEP 1536:1HTJKqOS3aVSqznL8HTJKqOS3aVSqznLk:JTJK5SKcSQTJK5SKcSA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\Media Renderer\DMR_120.exe
- Size 55KB
- SHA256 732643b138058a9e78e4d470283af2982566f678a184b787552fbb6e211af9fc
- MD5 aa4a0ff6290d8223db6d04553b1bca55
- SHA1 c9587464635912ed24dd403e45154589aff8e6fe
- SHA512 20de29dcdfe091286667f69de21e30064140a3826c6b9505010f88771095240290640a8b880c9009ede8dc73d894f10f4a4b2e9563427c7d683d03826bb6db21
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOYoLcN9:1HTJKqOS3aVSqzn/p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\Media Renderer\DMR_120.exe
- Size 55KB
- SHA256 732643b138058a9e78e4d470283af2982566f678a184b787552fbb6e211af9fc
- MD5 aa4a0ff6290d8223db6d04553b1bca55
- SHA1 c9587464635912ed24dd403e45154589aff8e6fe
- SHA512 20de29dcdfe091286667f69de21e30064140a3826c6b9505010f88771095240290640a8b880c9009ede8dc73d894f10f4a4b2e9563427c7d683d03826bb6db21
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOYoLcN9:1HTJKqOS3aVSqzn/p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\Media Renderer\DMR_48.exe
- Size 53KB
- SHA256 fd040168f07b6aca2fc7d9dcf415a2ef9f8f3926dd308fceeb4ab8db8947382e
- MD5 3aa5d10b2cd74b643a7c5ba36433c6c8
- SHA1 7447e8367bf6f80bb85e8f1961f1823f251d3182
- SHA512 b8e87f125edccbdcb1a8c84734a98421f076f64f7dae8e9ac7b94091fa51500bcac55eefa1364f62518cae07d4edb3b1e6f779aad64f10909eb30001afadc0f8
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOiD:1HTJKqOS3aVSqzndD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\Media Renderer\DMR_48.exe
- Size 53KB
- SHA256 fd040168f07b6aca2fc7d9dcf415a2ef9f8f3926dd308fceeb4ab8db8947382e
- MD5 3aa5d10b2cd74b643a7c5ba36433c6c8
- SHA1 7447e8367bf6f80bb85e8f1961f1823f251d3182
- SHA512 b8e87f125edccbdcb1a8c84734a98421f076f64f7dae8e9ac7b94091fa51500bcac55eefa1364f62518cae07d4edb3b1e6f779aad64f10909eb30001afadc0f8
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOiD:1HTJKqOS3aVSqzndD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.exe
- Size 57KB
- SHA256 9e5c0b9dba4c03849178df52ae23138cc6a70666ddc04516a3a4365e699d7ab6
- MD5 30a8695f168538db192c865b34b523e6
- SHA1 8cf9b362c403408e449ed2a183eed663ddaa9332
- SHA512 508ba0bb17fbf96b1ee4051fd36466197d4b0ff3a99776330607a52342c8c66ef32f0b5c173cb63e7170563d760bd254c9a21310ece775996e9940da50e19ec8
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytO+g:1HTJKqOS3aVSqzn8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.exe
- Size 57KB
- SHA256 9e5c0b9dba4c03849178df52ae23138cc6a70666ddc04516a3a4365e699d7ab6
- MD5 30a8695f168538db192c865b34b523e6
- SHA1 8cf9b362c403408e449ed2a183eed663ddaa9332
- SHA512 508ba0bb17fbf96b1ee4051fd36466197d4b0ff3a99776330607a52342c8c66ef32f0b5c173cb63e7170563d760bd254c9a21310ece775996e9940da50e19ec8
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytO+g:1HTJKqOS3aVSqzn8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.exe
- Size 57KB
- SHA256 9e5c0b9dba4c03849178df52ae23138cc6a70666ddc04516a3a4365e699d7ab6
- MD5 30a8695f168538db192c865b34b523e6
- SHA1 8cf9b362c403408e449ed2a183eed663ddaa9332
- SHA512 508ba0bb17fbf96b1ee4051fd36466197d4b0ff3a99776330607a52342c8c66ef32f0b5c173cb63e7170563d760bd254c9a21310ece775996e9940da50e19ec8
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytO+g:1HTJKqOS3aVSqzn8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.exe
- Size 54KB
- SHA256 deb0e11c6662ae6a0a9eb7beeb03ced6eef2cd18fac82a8e514c5b93cbcc7c3e
- MD5 b8e63d10143ba02cb9662c775fd4de9f
- SHA1 5f007b602a545d799787d2b67898c52ce724052b
- SHA512 b1a92021822487ea3978fb1cc8ca6443ac1bfe63632d4bde8c1d11dea9cfdc5a3ebad2930530233589d96e19422821695638d3be5556be28b82a4694eb1dcbe9
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOx:1HTJKqOS3aVSqzn0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.exe
- Size 54KB
- SHA256 deb0e11c6662ae6a0a9eb7beeb03ced6eef2cd18fac82a8e514c5b93cbcc7c3e
- MD5 b8e63d10143ba02cb9662c775fd4de9f
- SHA1 5f007b602a545d799787d2b67898c52ce724052b
- SHA512 b1a92021822487ea3978fb1cc8ca6443ac1bfe63632d4bde8c1d11dea9cfdc5a3ebad2930530233589d96e19422821695638d3be5556be28b82a4694eb1dcbe9
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOx:1HTJKqOS3aVSqzn0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.exe
- Size 54KB
- SHA256 5b3c4f119cce1e3be5cc1f34511b0d37b3f5c1d3b5143077a7c57bec7982dc77
- MD5 958b253956fd89a0a11ed8fc83b386c4
- SHA1 3fdb4f72c4b0f02d57bb00c63c7b1a18d50b3693
- SHA512 9e8318536fead52c0a492f9d1f15a4c5aa71c7aefad909b2608e090b0a4f68ce8ff59fb5527a70307e36f175e975b2d0fef97e691e845c5f42aae1bf89f90172
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOrX:1HTJKqOS3aVSqznI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.exe
- Size 54KB
- SHA256 5b3c4f119cce1e3be5cc1f34511b0d37b3f5c1d3b5143077a7c57bec7982dc77
- MD5 958b253956fd89a0a11ed8fc83b386c4
- SHA1 3fdb4f72c4b0f02d57bb00c63c7b1a18d50b3693
- SHA512 9e8318536fead52c0a492f9d1f15a4c5aa71c7aefad909b2608e090b0a4f68ce8ff59fb5527a70307e36f175e975b2d0fef97e691e845c5f42aae1bf89f90172
- SSDEEP 768:3lHSuJKqyLoh6sqd+MtSOS51tbEBvsecytOrX:1HTJKqOS3aVSqznI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Executioner.exe
- Size 149KB
- SHA256 b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af
- MD5 4f47c6f97a61e28c251ccba05c7c9b86
- SHA1 4661d019647d28f9a7687f46ab9dfb25f52cc77c
- SHA512 225c0a388317a7f08d01af3fb974dce7d079176292224b6cda26fac5bd90910284cdf92a45eaf7f8473cea6caba5667b8d6d9bdf14dc57429b199105bcb6690a
- SSDEEP 3072:JTJK5SKcSNFcmTJK5cjMWoe0c8TilDcq15:JTJrRyWmTJh5yc8TO915
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Executioner.exe
- Size 149KB
- SHA256 b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af
- MD5 4f47c6f97a61e28c251ccba05c7c9b86
- SHA1 4661d019647d28f9a7687f46ab9dfb25f52cc77c
- SHA512 225c0a388317a7f08d01af3fb974dce7d079176292224b6cda26fac5bd90910284cdf92a45eaf7f8473cea6caba5667b8d6d9bdf14dc57429b199105bcb6690a
- SSDEEP 3072:JTJK5SKcSNFcmTJK5cjMWoe0c8TilDcq15:JTJrRyWmTJh5yc8TO915
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Executioner.exe
- Size 149KB
- SHA256 b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af
- MD5 4f47c6f97a61e28c251ccba05c7c9b86
- SHA1 4661d019647d28f9a7687f46ab9dfb25f52cc77c
- SHA512 225c0a388317a7f08d01af3fb974dce7d079176292224b6cda26fac5bd90910284cdf92a45eaf7f8473cea6caba5667b8d6d9bdf14dc57429b199105bcb6690a
- SSDEEP 3072:JTJK5SKcSNFcmTJK5cjMWoe0c8TilDcq15:JTJrRyWmTJh5yc8TO915
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\Dakila.nfo
- Size 13B
- SHA256 918ded25f95297bd62c0c1bf1bedee75568fa7df79c643bde120c287ac61f6e1
- MD5 267cc58988d233a0e6614d4c6e5a8dd5
- SHA1 ba769a9c5ffedecbaa6bb017862d52c36ad306c1
- SHA512 6e25e7a7efc855ecc33ca14bb1c3a829db5e5b5709dfa3bfdff040e4228065475a8c857b00cea7736c9e47a64018bfad902713c69f575f6b343c64227c186e54
- MD5 SHA1 SHA512
- Path C:\Windows\b457f291369ba42e32b5eac7cd721d12d5aa943442be103749756bfdd06283af.jpg
- Size 97KB
- SHA256 d4d6ef8cc38c4eefd9e8da8c0ae3237c9caa41868749fe968b5e50ec05dbb1ab
- MD5 6002f55af3cfc00f7985865dab16fdf4
- SHA1 932ebb5b11a29170cffe977210019cb1bf027d9f
- SHA512 f54c8e52c775dd607b3f051ccf2f46deb32a2ac070296f7a8058db750efb4a97c4e5394d3dec417507bbd5f05d13952777a0d72c63f19b6aed0b8d674947e238
- SSDEEP 1536:5jx0yHAKHTJKqOcjMeppppjlCe0c8T40q5vDDZmq15:5FcmTJK5cjMWoe0c8TilDcq15
- MD5 SHA1 SHA512 SSDEEP
