Analysis
- max time kernel
156s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
06/11/2022, 14:03
Static task
static1
Behavioral task
behavioral1
Sample
9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe
Resource
win7-20220812-en
windows7-x64
19 signatures
150 seconds
General
- Target 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe
- Size 654KB
- Sample221106-rcxa9seeb3
- SHA256 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d
- MD5 0db30725cbfa5e2c637bef3af4bb6f4c
- SHA1 4605537cff07fbc9da76d348de35c1afec22c845
- SHA512 316bcb50363d2f5703a8ddfcf8eec9a551fa8d8b082ac75f175c1866707443cbbeb6273fa788bc9eb0576492e8e90673deff401bbcb8d728d9ebf0fe69ebdcde
- SSDEEP 12288:YvLTZpVGFZujSPy9aT6Ro8sRynIcM5QgYnImYoD50qcHLU9LQkfS:YvfVmhmQ60DY15t0qILUWm
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Extracted
Family
-
cybergate
Version
-
v1.02.0
Botnet
-
neu
C2
-
sfasgrhhee.no-ip.biz:81
Mutex
-
HVHO82NITFAT3F
Attributes
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
systeme
-
install_file
upsate.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
tannenbaum
Signatures
- Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\winlogon.exe = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MORPH_09.06.2010-23_58_44.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe - Adds policy Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\systeme\\upsate.exe" 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\systeme\\upsate.exe" 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run MORPH_09.06.2010-23_58_44.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" MORPH_09.06.2010-23_58_44.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe - Executes dropped EXE 10 IoCs
pid Process 840 MORPH_09.06.2010-23_58_44.EXE 1300 MORPH_09.06.2010-23_58_44.EXE 4424 upsate.exe 4972 upsate.exe 3772 MORPH_09.06.2010-23_58_44.EXE 1404 MORPH_09.06.2010-23_58_44.EXE 4196 upsate.exe 2172 upsate.exe 1128 MORPH_09.06.2010-23_58_44.EXE 3960 MORPH_09.06.2010-23_58_44.EXE - Modifies Installed Components in the registry 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{8CBBADEE-EF4B-FB5C-D13D-BA32A85EE2B6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" MORPH_09.06.2010-23_58_44.EXE Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{828VL620-1355-65FS-2764-2H4B4JU4MJAU} 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{828VL620-1355-65FS-2764-2H4B4JU4MJAU}\StubPath = "C:\\Windows\\systeme\\upsate.exe Restart" 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8CBBADEE-EF4B-FB5C-D13D-BA32A85EE2B6} MORPH_09.06.2010-23_58_44.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8CBBADEE-EF4B-FB5C-D13D-BA32A85EE2B6}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" MORPH_09.06.2010-23_58_44.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{8CBBADEE-EF4B-FB5C-D13D-BA32A85EE2B6} MORPH_09.06.2010-23_58_44.EXE -
resource yara_rule behavioral2/memory/1340-138-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1340-142-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1340-143-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1340-144-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1300-146-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral2/memory/1300-151-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral2/memory/1300-154-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral2/memory/1340-168-0x0000000024010000-0x000000002406F000-memory.dmp upx behavioral2/memory/1496-171-0x0000000024010000-0x000000002406F000-memory.dmp upx behavioral2/memory/1340-176-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1496-177-0x0000000024010000-0x000000002406F000-memory.dmp upx behavioral2/memory/4196-203-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2172-204-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4196-197-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/4196-205-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2172-206-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1128-230-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral2/memory/3960-231-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral2/memory/3960-232-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral2/memory/1128-233-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral2/memory/3960-234-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral2/memory/1300-235-0x0000000000400000-0x000000000045A000-memory.dmp upx behavioral2/memory/4196-236-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/2172-237-0x0000000000400000-0x0000000000453000-memory.dmp upx behavioral2/memory/1496-238-0x0000000024010000-0x000000002406F000-memory.dmp upx - Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation upsate.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation upsate.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation MORPH_09.06.2010-23_58_44.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation MORPH_09.06.2010-23_58_44.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation MORPH_09.06.2010-23_58_44.EXE Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run MORPH_09.06.2010-23_58_44.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" MORPH_09.06.2010-23_58_44.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MORPH_09.06.2010-23_58_44.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Winlogon = "C:\\Users\\Admin\\AppData\\Roaming\\winlogon.exe" MORPH_09.06.2010-23_58_44.EXE - Enumerates connected drives 3 TTPs 3 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: cmd.exe File opened (read-only) \??\M: cmd.exe File opened (read-only) \??\M: cmd.exe - Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 3260 set thread context of 1340 3260 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 80 PID 840 set thread context of 1300 840 MORPH_09.06.2010-23_58_44.EXE 81 PID 4424 set thread context of 4196 4424 upsate.exe 102 PID 4972 set thread context of 2172 4972 upsate.exe 103 PID 3772 set thread context of 1128 3772 MORPH_09.06.2010-23_58_44.EXE 104 PID 1404 set thread context of 3960 1404 MORPH_09.06.2010-23_58_44.EXE 105 - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\systeme\upsate.exe 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe File opened for modification C:\Windows\systeme\upsate.exe 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies registry key 1 TTPs 4 IoCs
pid Process 1004 reg.exe 4592 reg.exe 4628 reg.exe 2308 reg.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 4196 upsate.exe 4196 upsate.exe 2172 upsate.exe 2172 upsate.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1496 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 1 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeCreateTokenPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeAssignPrimaryTokenPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeLockMemoryPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeIncreaseQuotaPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeMachineAccountPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeTcbPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeSecurityPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeTakeOwnershipPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeLoadDriverPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeSystemProfilePrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeSystemtimePrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeProfSingleProcessPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeIncBasePriorityPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeCreatePagefilePrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeCreatePermanentPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeBackupPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeRestorePrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeShutdownPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeDebugPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeAuditPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeSystemEnvironmentPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeChangeNotifyPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeRemoteShutdownPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeUndockPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeSyncAgentPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeEnableDelegationPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeManageVolumePrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeImpersonatePrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeCreateGlobalPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: 31 1300 MORPH_09.06.2010-23_58_44.EXE Token: 32 1300 MORPH_09.06.2010-23_58_44.EXE Token: 33 1300 MORPH_09.06.2010-23_58_44.EXE Token: 34 1300 MORPH_09.06.2010-23_58_44.EXE Token: 35 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeDebugPrivilege 1300 MORPH_09.06.2010-23_58_44.EXE Token: SeDebugPrivilege 1496 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe Token: SeDebugPrivilege 1496 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe Token: 1 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeCreateTokenPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeAssignPrimaryTokenPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeLockMemoryPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeIncreaseQuotaPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeMachineAccountPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeTcbPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeSecurityPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeTakeOwnershipPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeLoadDriverPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeSystemProfilePrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeSystemtimePrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeProfSingleProcessPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeIncBasePriorityPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeCreatePagefilePrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeCreatePermanentPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeBackupPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeRestorePrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeShutdownPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeDebugPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeAuditPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeSystemEnvironmentPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeChangeNotifyPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeRemoteShutdownPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeUndockPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE Token: SeSyncAgentPrivilege 1128 MORPH_09.06.2010-23_58_44.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1300 MORPH_09.06.2010-23_58_44.EXE 1300 MORPH_09.06.2010-23_58_44.EXE 1128 MORPH_09.06.2010-23_58_44.EXE 1128 MORPH_09.06.2010-23_58_44.EXE 3960 MORPH_09.06.2010-23_58_44.EXE 3960 MORPH_09.06.2010-23_58_44.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3260 wrote to memory of 840 3260 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 79 PID 3260 wrote to memory of 840 3260 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 79 PID 3260 wrote to memory of 840 3260 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 79 PID 3260 wrote to memory of 1340 3260 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 80 PID 3260 wrote to memory of 1340 3260 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 80 PID 3260 wrote to memory of 1340 3260 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 80 PID 3260 wrote to memory of 1340 3260 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 80 PID 3260 wrote to memory of 1340 3260 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 80 PID 3260 wrote to memory of 1340 3260 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 80 PID 3260 wrote to memory of 1340 3260 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 80 PID 840 wrote to memory of 1300 840 MORPH_09.06.2010-23_58_44.EXE 81 PID 840 wrote to memory of 1300 840 MORPH_09.06.2010-23_58_44.EXE 81 PID 840 wrote to memory of 1300 840 MORPH_09.06.2010-23_58_44.EXE 81 PID 840 wrote to memory of 1300 840 MORPH_09.06.2010-23_58_44.EXE 81 PID 840 wrote to memory of 1300 840 MORPH_09.06.2010-23_58_44.EXE 81 PID 840 wrote to memory of 1300 840 MORPH_09.06.2010-23_58_44.EXE 81 PID 840 wrote to memory of 1300 840 MORPH_09.06.2010-23_58_44.EXE 81 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 840 wrote to memory of 1536 840 MORPH_09.06.2010-23_58_44.EXE 83 PID 840 wrote to memory of 1536 840 MORPH_09.06.2010-23_58_44.EXE 83 PID 840 wrote to memory of 1536 840 MORPH_09.06.2010-23_58_44.EXE 83 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82 PID 1340 wrote to memory of 1496 1340 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe 82
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe"C:\Users\Admin\AppData\Local\Temp\9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe"2⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE"C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXEC:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1300 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:2980
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies firewall policy service
- Modifies registry key
PID:4592
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.exe:*:Enabled:Windows Messanger" /f5⤵PID:2780
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies firewall policy service
- Modifies registry key
PID:1004
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f5⤵PID:812
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f6⤵
- Modifies firewall policy service
- Modifies registry key
PID:2308
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f5⤵PID:2492
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winlogon.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winlogon.exe:*:Enabled:Windows Messanger" /f6⤵
- Modifies firewall policy service
- Modifies registry key
PID:4628
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UBADATA5.BAT" "4⤵
- Enumerates connected drives
PID:1536
-
-
-
C:\Users\Admin\AppData\Local\Temp\9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exeC:\Users\Admin\AppData\Local\Temp\9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe3⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe"C:\Users\Admin\AppData\Local\Temp\9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d.exe"4⤵
- Checks computer location settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1496 -
C:\Windows\systeme\upsate.exe"C:\Windows\systeme\upsate.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE"C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE"6⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXEC:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3960
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UBADATA5.BAT" "7⤵
- Enumerates connected drives
PID:3224
-
-
-
C:\Windows\systeme\upsate.exeC:\Windows\systeme\upsate.exe6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2172
-
-
-
-
C:\Windows\systeme\upsate.exe"C:\Windows\systeme\upsate.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE"C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXEC:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1128
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UBADATA5.BAT" "6⤵
- Enumerates connected drives
PID:4228
-
-
-
C:\Windows\systeme\upsate.exeC:\Windows\systeme\upsate.exe5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4196
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE
- Size 260KB
- SHA256 16a13e26927e5cf1856df23b50cf7155c8ba37760bf546f12678c26775628c49
- MD5 7cd94698c7490a5c39ec314c0c0c7d94
- SHA1 88f2d18c82e18360109ec758fb0804cbf5edffee
- SHA512 acd16a237354debee0b36807072fcf828d52dc4ce50528e948c7d1fb34baa258161f2a05e2de4c2c20efe5a45eee1ac9f11319ce05b14bd35cd1cc1100c763a9
- SSDEEP 3072:Uy/EO9q/AJi5+TAk+a+MokdU/V1g2uaca17BOB64lAqS1JDHfQB8ZH3s0RLV:UiiQ+BIU/V1buaca1BPoZ2JD1ZHc0R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE
- Size 260KB
- SHA256 16a13e26927e5cf1856df23b50cf7155c8ba37760bf546f12678c26775628c49
- MD5 7cd94698c7490a5c39ec314c0c0c7d94
- SHA1 88f2d18c82e18360109ec758fb0804cbf5edffee
- SHA512 acd16a237354debee0b36807072fcf828d52dc4ce50528e948c7d1fb34baa258161f2a05e2de4c2c20efe5a45eee1ac9f11319ce05b14bd35cd1cc1100c763a9
- SSDEEP 3072:Uy/EO9q/AJi5+TAk+a+MokdU/V1g2uaca17BOB64lAqS1JDHfQB8ZH3s0RLV:UiiQ+BIU/V1buaca1BPoZ2JD1ZHc0R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE
- Size 260KB
- SHA256 16a13e26927e5cf1856df23b50cf7155c8ba37760bf546f12678c26775628c49
- MD5 7cd94698c7490a5c39ec314c0c0c7d94
- SHA1 88f2d18c82e18360109ec758fb0804cbf5edffee
- SHA512 acd16a237354debee0b36807072fcf828d52dc4ce50528e948c7d1fb34baa258161f2a05e2de4c2c20efe5a45eee1ac9f11319ce05b14bd35cd1cc1100c763a9
- SSDEEP 3072:Uy/EO9q/AJi5+TAk+a+MokdU/V1g2uaca17BOB64lAqS1JDHfQB8ZH3s0RLV:UiiQ+BIU/V1buaca1BPoZ2JD1ZHc0R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE
- Size 260KB
- SHA256 16a13e26927e5cf1856df23b50cf7155c8ba37760bf546f12678c26775628c49
- MD5 7cd94698c7490a5c39ec314c0c0c7d94
- SHA1 88f2d18c82e18360109ec758fb0804cbf5edffee
- SHA512 acd16a237354debee0b36807072fcf828d52dc4ce50528e948c7d1fb34baa258161f2a05e2de4c2c20efe5a45eee1ac9f11319ce05b14bd35cd1cc1100c763a9
- SSDEEP 3072:Uy/EO9q/AJi5+TAk+a+MokdU/V1g2uaca17BOB64lAqS1JDHfQB8ZH3s0RLV:UiiQ+BIU/V1buaca1BPoZ2JD1ZHc0R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE
- Size 260KB
- SHA256 16a13e26927e5cf1856df23b50cf7155c8ba37760bf546f12678c26775628c49
- MD5 7cd94698c7490a5c39ec314c0c0c7d94
- SHA1 88f2d18c82e18360109ec758fb0804cbf5edffee
- SHA512 acd16a237354debee0b36807072fcf828d52dc4ce50528e948c7d1fb34baa258161f2a05e2de4c2c20efe5a45eee1ac9f11319ce05b14bd35cd1cc1100c763a9
- SSDEEP 3072:Uy/EO9q/AJi5+TAk+a+MokdU/V1g2uaca17BOB64lAqS1JDHfQB8ZH3s0RLV:UiiQ+BIU/V1buaca1BPoZ2JD1ZHc0R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE
- Size 260KB
- SHA256 16a13e26927e5cf1856df23b50cf7155c8ba37760bf546f12678c26775628c49
- MD5 7cd94698c7490a5c39ec314c0c0c7d94
- SHA1 88f2d18c82e18360109ec758fb0804cbf5edffee
- SHA512 acd16a237354debee0b36807072fcf828d52dc4ce50528e948c7d1fb34baa258161f2a05e2de4c2c20efe5a45eee1ac9f11319ce05b14bd35cd1cc1100c763a9
- SSDEEP 3072:Uy/EO9q/AJi5+TAk+a+MokdU/V1g2uaca17BOB64lAqS1JDHfQB8ZH3s0RLV:UiiQ+BIU/V1buaca1BPoZ2JD1ZHc0R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE
- Size 260KB
- SHA256 16a13e26927e5cf1856df23b50cf7155c8ba37760bf546f12678c26775628c49
- MD5 7cd94698c7490a5c39ec314c0c0c7d94
- SHA1 88f2d18c82e18360109ec758fb0804cbf5edffee
- SHA512 acd16a237354debee0b36807072fcf828d52dc4ce50528e948c7d1fb34baa258161f2a05e2de4c2c20efe5a45eee1ac9f11319ce05b14bd35cd1cc1100c763a9
- SSDEEP 3072:Uy/EO9q/AJi5+TAk+a+MokdU/V1g2uaca17BOB64lAqS1JDHfQB8ZH3s0RLV:UiiQ+BIU/V1buaca1BPoZ2JD1ZHc0R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\MORPH_09.06.2010-23_58_44.EXE
- Size 260KB
- SHA256 16a13e26927e5cf1856df23b50cf7155c8ba37760bf546f12678c26775628c49
- MD5 7cd94698c7490a5c39ec314c0c0c7d94
- SHA1 88f2d18c82e18360109ec758fb0804cbf5edffee
- SHA512 acd16a237354debee0b36807072fcf828d52dc4ce50528e948c7d1fb34baa258161f2a05e2de4c2c20efe5a45eee1ac9f11319ce05b14bd35cd1cc1100c763a9
- SSDEEP 3072:Uy/EO9q/AJi5+TAk+a+MokdU/V1g2uaca17BOB64lAqS1JDHfQB8ZH3s0RLV:UiiQ+BIU/V1buaca1BPoZ2JD1ZHc0R
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\UBADATA5.BAT
- Size 297B
- SHA256 5395d2c26a3e3b44844a054ea36247dbdd6c2fe80c20c06673d3b1bccdd892c8
- MD5 de0af4f75b6ee10c81ef67f39ba3dbdb
- SHA1 cc67e15ebf9952cbe7854a1c707fefe88de5c24d
- SHA512 a2e7b2079e5bbca1c668c7be822a3b8dea054e6740aa90e38ce638e044ddcea4fec988664171deb7dac3ee4880f8689358e7334d6e02a6295cab06e6edc4e6b4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\UBADATA5.BAT
- Size 297B
- SHA256 5395d2c26a3e3b44844a054ea36247dbdd6c2fe80c20c06673d3b1bccdd892c8
- MD5 de0af4f75b6ee10c81ef67f39ba3dbdb
- SHA1 cc67e15ebf9952cbe7854a1c707fefe88de5c24d
- SHA512 a2e7b2079e5bbca1c668c7be822a3b8dea054e6740aa90e38ce638e044ddcea4fec988664171deb7dac3ee4880f8689358e7334d6e02a6295cab06e6edc4e6b4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\XX--XX--XX.txt
- Size 219KB
- SHA256 c0dfeaeb498cd9efdceb79c6ef89a6a9e289e41e7e5a017f049cb67f9ffab0a5
- MD5 85feb9d40c55d37105d76aa0366daa77
- SHA1 942dd9fb2acbc8959518d27662a0027205b07e70
- SHA512 cd387b90ed71b43e6f91275100ac6331c07e01afba44e83b15d77df92fec5664248ba4e651fabf451befa872103b4b395e1d438610e6a4b9cc4eb8cca31efb40
- SSDEEP 6144:FsxZZQttyCVxaWYSdMU/77hlruc6XmDoTbcI7CPPdm:FeAtpVxagMU/plruchDofAPI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\systeme\upsate.exe
- Size 654KB
- SHA256 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d
- MD5 0db30725cbfa5e2c637bef3af4bb6f4c
- SHA1 4605537cff07fbc9da76d348de35c1afec22c845
- SHA512 316bcb50363d2f5703a8ddfcf8eec9a551fa8d8b082ac75f175c1866707443cbbeb6273fa788bc9eb0576492e8e90673deff401bbcb8d728d9ebf0fe69ebdcde
- SSDEEP 12288:YvLTZpVGFZujSPy9aT6Ro8sRynIcM5QgYnImYoD50qcHLU9LQkfS:YvfVmhmQ60DY15t0qILUWm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\systeme\upsate.exe
- Size 654KB
- SHA256 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d
- MD5 0db30725cbfa5e2c637bef3af4bb6f4c
- SHA1 4605537cff07fbc9da76d348de35c1afec22c845
- SHA512 316bcb50363d2f5703a8ddfcf8eec9a551fa8d8b082ac75f175c1866707443cbbeb6273fa788bc9eb0576492e8e90673deff401bbcb8d728d9ebf0fe69ebdcde
- SSDEEP 12288:YvLTZpVGFZujSPy9aT6Ro8sRynIcM5QgYnImYoD50qcHLU9LQkfS:YvfVmhmQ60DY15t0qILUWm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\systeme\upsate.exe
- Size 654KB
- SHA256 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d
- MD5 0db30725cbfa5e2c637bef3af4bb6f4c
- SHA1 4605537cff07fbc9da76d348de35c1afec22c845
- SHA512 316bcb50363d2f5703a8ddfcf8eec9a551fa8d8b082ac75f175c1866707443cbbeb6273fa788bc9eb0576492e8e90673deff401bbcb8d728d9ebf0fe69ebdcde
- SSDEEP 12288:YvLTZpVGFZujSPy9aT6Ro8sRynIcM5QgYnImYoD50qcHLU9LQkfS:YvfVmhmQ60DY15t0qILUWm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\systeme\upsate.exe
- Size 654KB
- SHA256 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d
- MD5 0db30725cbfa5e2c637bef3af4bb6f4c
- SHA1 4605537cff07fbc9da76d348de35c1afec22c845
- SHA512 316bcb50363d2f5703a8ddfcf8eec9a551fa8d8b082ac75f175c1866707443cbbeb6273fa788bc9eb0576492e8e90673deff401bbcb8d728d9ebf0fe69ebdcde
- SSDEEP 12288:YvLTZpVGFZujSPy9aT6Ro8sRynIcM5QgYnImYoD50qcHLU9LQkfS:YvfVmhmQ60DY15t0qILUWm
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\systeme\upsate.exe
- Size 654KB
- SHA256 9f1bd7e07bb3feaa64b1ac17904a92ae84cf68934270e4d17c563b86d789b24d
- MD5 0db30725cbfa5e2c637bef3af4bb6f4c
- SHA1 4605537cff07fbc9da76d348de35c1afec22c845
- SHA512 316bcb50363d2f5703a8ddfcf8eec9a551fa8d8b082ac75f175c1866707443cbbeb6273fa788bc9eb0576492e8e90673deff401bbcb8d728d9ebf0fe69ebdcde
- SSDEEP 12288:YvLTZpVGFZujSPy9aT6Ro8sRynIcM5QgYnImYoD50qcHLU9LQkfS:YvfVmhmQ60DY15t0qILUWm
- MD5 SHA1 SHA512 SSDEEP