Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
23/10/2022, 08:51
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target file.exe
- Size 217KB
- Sample221023-kr54dshdb9
- SHA256 5356dfc8d72b534ffb3897042cccf3d4b30a74fe89252da8f8ac96c7e3593fb0
- MD5 ae6802727d84ab0192d420a2392d48eb
- SHA1 f79b9e59deaa9046ae776cfcb3ae18ddd52c1805
- SHA512 9df9eb0799a6bf2897557b225bef1292bcde64922bc40cced4de1fafc51e14d49e62412b9764e08c88e69f18640783a973d19271c84fb371443cfacecfd19e0e
- SSDEEP 3072:yXluwL0kqD5yHHqFuJ3uGg0/b8/wA9fnnkFdSBzAnzRj:yowLLqQqFuJ3yT9fnkFdSBEnV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
danabot
Attributes
-
embedded_hash
569235DCA8F16ED8310BBACCB674F896
-
type
loader
Extracted
Family
-
nymaim
C2
-
45.139.105.171
-
85.31.46.167
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/792-133-0x0000000002C30000-0x0000000002C39000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 1 IoCs
flow pid Process 85 4848 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
pid Process 4996 FED7.exe 892 1732.exe 4324 1FDE.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 1FDE.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 1732.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4996 set thread context of 4848 4996 FED7.exe 143 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 20 IoCs
pid pid_target Process procid_target 5112 4324 WerFault.exe 93 4872 4324 WerFault.exe 93 3604 4324 WerFault.exe 93 3608 4324 WerFault.exe 93 828 4324 WerFault.exe 93 4496 4324 WerFault.exe 93 2276 4324 WerFault.exe 93 2020 4324 WerFault.exe 93 1840 4324 WerFault.exe 93 3136 4324 WerFault.exe 93 4384 4996 WerFault.exe 83 3728 4996 WerFault.exe 83 792 4996 WerFault.exe 83 2892 4996 WerFault.exe 83 4776 4996 WerFault.exe 83 1260 4996 WerFault.exe 83 4228 4996 WerFault.exe 83 1952 4996 WerFault.exe 83 1684 4996 WerFault.exe 83 2868 4996 WerFault.exe 83 - Checks SCSI registry key(s) 3 TTPs 39 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 svchost.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 svchost.exe - Checks processor information in registry 2 TTPs 37 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision FED7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data FED7.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision FED7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status FED7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information FED7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz FED7.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FED7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 FED7.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 FED7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier FED7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet FED7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 FED7.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor FED7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision FED7.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz FED7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 FED7.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision FED7.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor FED7.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 FED7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information FED7.exe - Kills process with taskkill 1 IoCs
pid Process 4484 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found - Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings FED7.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings OpenWith.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3092 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 792 file.exe 792 file.exe 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found 3092 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3092 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 792 file.exe - Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 364 svchost.exe Token: SeShutdownPrivilege 364 svchost.exe Token: SeCreatePagefilePrivilege 364 svchost.exe Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeDebugPrivilege 4484 taskkill.exe Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found Token: SeShutdownPrivilege 3092 Process not Found Token: SeCreatePagefilePrivilege 3092 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4848 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1368 OpenWith.exe 3092 Process not Found 3092 Process not Found - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 3092 wrote to memory of 4996 3092 Process not Found 83 PID 3092 wrote to memory of 4996 3092 Process not Found 83 PID 3092 wrote to memory of 4996 3092 Process not Found 83 PID 4996 wrote to memory of 1044 4996 FED7.exe 85 PID 4996 wrote to memory of 1044 4996 FED7.exe 85 PID 4996 wrote to memory of 1044 4996 FED7.exe 85 PID 3092 wrote to memory of 892 3092 Process not Found 90 PID 3092 wrote to memory of 892 3092 Process not Found 90 PID 3092 wrote to memory of 892 3092 Process not Found 90 PID 3092 wrote to memory of 4324 3092 Process not Found 93 PID 3092 wrote to memory of 4324 3092 Process not Found 93 PID 3092 wrote to memory of 4324 3092 Process not Found 93 PID 4324 wrote to memory of 2536 4324 1FDE.exe 116 PID 4324 wrote to memory of 2536 4324 1FDE.exe 116 PID 4324 wrote to memory of 2536 4324 1FDE.exe 116 PID 2536 wrote to memory of 4484 2536 cmd.exe 120 PID 2536 wrote to memory of 4484 2536 cmd.exe 120 PID 2536 wrote to memory of 4484 2536 cmd.exe 120 PID 4996 wrote to memory of 4848 4996 FED7.exe 143 PID 4996 wrote to memory of 4848 4996 FED7.exe 143 PID 4996 wrote to memory of 4848 4996 FED7.exe 143 PID 4996 wrote to memory of 4848 4996 FED7.exe 143
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:792
-
C:\Users\Admin\AppData\Local\Temp\FED7.exeC:\Users\Admin\AppData\Local\Temp\FED7.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Windows\SysWOW64\agentactivationruntimestarter.exeC:\Windows\system32\agentactivationruntimestarter.exe2⤵PID:1044
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 4202⤵
- Program crash
PID:4384
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 9482⤵
- Program crash
PID:3728
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 9482⤵
- Program crash
PID:792
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 10962⤵
- Program crash
PID:2892
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 11162⤵
- Program crash
PID:4776
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 11402⤵
- Program crash
PID:1260
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 11402⤵
- Program crash
PID:4228
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 10922⤵
- Program crash
PID:1952
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 10522⤵
- Program crash
PID:1684
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\syswow64\rundll32.exe" "C:\Windows\syswow64\shell32.dll",#612⤵
- Blocklisted process makes network request
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:4848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 14442⤵
- Program crash
PID:2868
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k AarSvcGroup -p -s AarSvc1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:364
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f4 0x3cc1⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\1732.exeC:\Users\Admin\AppData\Local\Temp\1732.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:892
-
C:\Users\Admin\AppData\Local\Temp\1FDE.exeC:\Users\Admin\AppData\Local\Temp\1FDE.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4324 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 4522⤵
- Program crash
PID:5112
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 7642⤵
- Program crash
PID:4872
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 8082⤵
- Program crash
PID:3604
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 8082⤵
- Program crash
PID:3608
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 7762⤵
- Program crash
PID:828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 9282⤵
- Program crash
PID:4496
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 9322⤵
- Program crash
PID:2276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 10362⤵
- Program crash
PID:2020
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 13562⤵
- Program crash
PID:1840
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "1FDE.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1FDE.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "1FDE.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4484
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4324 -s 13802⤵
- Program crash
PID:3136
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4324 -ip 43241⤵PID:1484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 4324 -ip 43241⤵PID:3616
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4324 -ip 43241⤵PID:2964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4324 -ip 43241⤵PID:848
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4324 -ip 43241⤵PID:3876
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 4324 -ip 43241⤵PID:4180
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4324 -ip 43241⤵PID:3384
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4324 -ip 43241⤵PID:1496
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 4324 -ip 43241⤵PID:2824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4324 -ip 43241⤵PID:3276
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 4996 -ip 49961⤵PID:5068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 4996 -ip 49961⤵PID:3788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 4996 -ip 49961⤵PID:568
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4996 -ip 49961⤵PID:4024
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 4996 -ip 49961⤵PID:636
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4996 -ip 49961⤵PID:4900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4996 -ip 49961⤵PID:3704
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 4996 -ip 49961⤵PID:4320
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1368
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 4996 -ip 49961⤵PID:484
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4996 -ip 49961⤵PID:828
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\1732.exe
- Size 519KB
- SHA256 f01a94918d3f7c456ba765a4fe19214a4e689466a0ec40de52bd799267962520
- MD5 943136d12339761db5695fc792539c9c
- SHA1 5570f7b5dbd94aee90190bf67d2fc585bb632efa
- SHA512 6e6ee9d98d9470c6a85e0bf5dbf23473e8b3c29d11e234706dbe6125330387965eb2c65b91e95efc299db68dea4edcbe4c20416af94be6b78898b559ec79fb13
- SSDEEP 12288:QINUecw0NEAwqyQo/+fQhNom2NlesRu1M8s4kmA:QocgAFyF/+Kt+lesavs4nA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1732.exe
- Size 519KB
- SHA256 f01a94918d3f7c456ba765a4fe19214a4e689466a0ec40de52bd799267962520
- MD5 943136d12339761db5695fc792539c9c
- SHA1 5570f7b5dbd94aee90190bf67d2fc585bb632efa
- SHA512 6e6ee9d98d9470c6a85e0bf5dbf23473e8b3c29d11e234706dbe6125330387965eb2c65b91e95efc299db68dea4edcbe4c20416af94be6b78898b559ec79fb13
- SSDEEP 12288:QINUecw0NEAwqyQo/+fQhNom2NlesRu1M8s4kmA:QocgAFyF/+Kt+lesavs4nA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1FDE.exe
- Size 286KB
- SHA256 ff2925b1ca4b0bc0b8443250eb3b509cc52861867cf6e524a84daf1c541812c1
- MD5 3d07385d3a8ed6d98ab7e3a03a59a22c
- SHA1 3b13b67d454b93fa67da0939ea185898174f4b1a
- SHA512 507ebd5008d2876681f93e8a0dae32b53dc3477a073e6aa319cdc49b1db8be531f7a3b7e35f2b9ed20972be4812e5c27bea89a8c6e95e472684995631d35204f
- SSDEEP 6144:0aRLQ4e77hIszARlM1GALL77Dhx8W0m/mB1wP:0aR84y7hJzeYG+HDhx90muB1wP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\1FDE.exe
- Size 286KB
- SHA256 ff2925b1ca4b0bc0b8443250eb3b509cc52861867cf6e524a84daf1c541812c1
- MD5 3d07385d3a8ed6d98ab7e3a03a59a22c
- SHA1 3b13b67d454b93fa67da0939ea185898174f4b1a
- SHA512 507ebd5008d2876681f93e8a0dae32b53dc3477a073e6aa319cdc49b1db8be531f7a3b7e35f2b9ed20972be4812e5c27bea89a8c6e95e472684995631d35204f
- SSDEEP 6144:0aRLQ4e77hIszARlM1GALL77Dhx8W0m/mB1wP:0aR84y7hJzeYG+HDhx90muB1wP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\FED7.exe
- Size 8.4MB
- SHA256 2cc410e6098f7728396fc012de165a158c0aed40f7b4854dedaba9d4a9ea286e
- MD5 c2cf02b46f9ed5c91d701806953a23dc
- SHA1 41d653a1509d6b11e9184f70aed12b88b688f824
- SHA512 c726c4af6feeabe709c6719b23b04c17be06ca6ee0b56054620553575bcfb398628ecbb61fd7f4ea90aae8cc530c90c1c0f60a9b1a6dc742f1b5e568be3cc5de
- SSDEEP 196608:FXzv6no48FZvrpTRJPaFrDlRxdMQ+d/6BgwZJ15l1WuVVMLHJxxkaNT:9vMUrpTRda5+M/xD1WurmHXCah
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\FED7.exe
- Size 8.4MB
- SHA256 2cc410e6098f7728396fc012de165a158c0aed40f7b4854dedaba9d4a9ea286e
- MD5 c2cf02b46f9ed5c91d701806953a23dc
- SHA1 41d653a1509d6b11e9184f70aed12b88b688f824
- SHA512 c726c4af6feeabe709c6719b23b04c17be06ca6ee0b56054620553575bcfb398628ecbb61fd7f4ea90aae8cc530c90c1c0f60a9b1a6dc742f1b5e568be3cc5de
- SSDEEP 196608:FXzv6no48FZvrpTRJPaFrDlRxdMQ+d/6BgwZJ15l1WuVVMLHJxxkaNT:9vMUrpTRda5+M/xD1WurmHXCah
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
- Size 25KB
- SHA256 c3db936d22f55c93214a38a5cc2b7a042b298822db68af0b4a574df37a1820db
- MD5 81afc5fdc60ea77324d4d8c4438e6510
- SHA1 4b21359d6a24d7096bd1f5afe2c100cb06829352
- SHA512 87e49d7bcf9f7d383ccf98ec4125402749db4bf954b8dc7c64177dd1ed254916a5b9a03903ccc01f0fc6bf635dc8640d3f9961156cd23882896c9b23fb472dcc
- SSDEEP 768:2/cTG175pcvVJgBBBBB3LJOgSs3MOPULIobKL3nZZZZZsQt:5TG19pfBBBBB3L6OPUMoMZZZZZsQt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Syhidsduo.tmp
- Size 3.3MB
- SHA256 db9190e9eb5298547a3d266f298ec1e7ede0426841da9512f2827f1e7c027520
- MD5 13d0ff809f24a408728fd6fe00241020
- SHA1 fde8484da982eceb86cf6959460ffc4ce33271a9
- SHA512 38dd1c523eb9f5aa1c3da0e95f4064f22fc191ce8cea20803c5f60fcbc40d83f5c3545529863ca18f4e65b3ea7a8eddc247ae0db11c6ffa70af560998611e768
- SSDEEP 98304:SxlplP5DXkQtCgfAKRToMtYwEh1D33K6m:SxnlRlCg/ToSMDnKr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TMKNGOMU-20220812-1924.log
- Size 56KB
- SHA256 1226acee43898580e53859127ed657800319973cb60df51155e5c8a7ce45e895
- MD5 942061e415bb8ead9b5a5218d5c14343
- SHA1 6017ef310882921100fa81965ff75e420200507d
- SHA512 b0a93f95992a6389ba9913d8ca29aaba421f25aea2463244468f3279185f88dddd3db4ecc9d58e4c73ac9901465548df24150978f3bc8a943376a176f605cddd
- SSDEEP 1536:mLUsQsETTcOWWWMT84wO8gwRjNj2BqdapyRt4iVbLswSq/cgb++G6B4Y6PzLH3rK:qxic2CgBqda83
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TMKNGOMU-20220812-1924a.log
- Size 181KB
- SHA256 ec82e4d884101d5d621ce4ff44a53f2114f73498bb0628479f67c37ec19124e8
- MD5 aa50dd7e6959589fc3fea20fe137bc6f
- SHA1 6db450ce52e3163161e1b90af4074a9d3bf47447
- SHA512 1e40a678922d3119ea6328b90e0a19d0f56a8498aca0aaeb5773336d292002352f7efdce467c09fc29acfc91bbc5bb6de3ba11d1ba2e1d46c1d0159f7ad17eb4
- SSDEEP 1536:1AoUPQeWtbOSbO0Wjh9WshcPnsPNmimxLKH9EW91Wng2009+TIcG3YtWu9WRx/8x:NFmY009+TIcG3p/C/2/jI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
- Size 1KB
- SHA256 833a02f36dfa5affbce525ec3c8ff76f17884fa6f058a31247aae3a5afc4f447
- MD5 807032b7314049329ebd06853899378d
- SHA1 5b92011b163eb80836c163163d7350731fac9bd8
- SHA512 2737573f6f344754cfd0d2562458743608a626fd03e21f728f459f49d2f529b85ae7f4be83cf91f0365e7275681458bf1baefc0e100c46a9ec07fe1638803241
- MD5 SHA1 SHA512