Analysis
- max time kernel
184s - max time network
195s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
19/11/2022, 16:43
Static task
static1
Behavioral task
behavioral1
Sample
a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe
Resource
win7-20221111-en
windows7-x64
26 signatures
150 seconds
General
- Target a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe
- Size 808KB
- Sample221119-t8mstabb79
- SHA256 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169
- MD5 51d070be7089f549f8eae9afbddb3a1b
- SHA1 9c9f09b27335355e3c8c22231bf66c038ee10207
- SHA512 4cb8bfe75c18666d3187275b0574b78758d55633d0e932faae271ceb411980a46420bd48ac6353fbd50b518d419b027d7b04d647fd728c3ba4e8f8ffa38be2ee
- SSDEEP 12288:5cyDz+j8zC/POs/RszSpabbs3JYNpYEzw8kY47hW6DgyPg7VjfAiABU:5c2+ms5pavs+NpM9nXg79CU
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "3" 3xiv.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" x276Ht.exe Set value (int) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" mevit.exe - Disables taskbar notifications via registry modification
- Executes dropped EXE 11 IoCs
pid Process 3368 x276Ht.exe 3328 2xiv.exe 1912 2xiv.exe 3212 3xiv.exe 4248 mevit.exe 3848 4xiv.exe 3452 X 3968 3xiv.exe 2120 5xiv.exe 848 A7C4.tmp 2116 3xiv.exe - Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
resource yara_rule behavioral2/memory/1912-145-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1912-148-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1912-149-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/1912-150-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/3212-162-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/3968-184-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral2/memory/3968-186-0x0000000000400000-0x000000000046B000-memory.dmp upx - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe Key value queried \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation x276Ht.exe - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 31.193.3.240 Destination IP 31.193.3.240 - Adds Run key to start application 2 TTPs 48 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /x" mevit.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\ mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /l" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /z" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /y" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /i" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /n" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /I" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /m" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /Z" x276Ht.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /Q" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /V" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /j" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /g" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /h" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /F" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /r" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /C" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /L" mevit.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run\ x276Ht.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /q" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /f" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /a" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /d" mevit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\C57.exe = "C:\\Program Files (x86)\\LP\\4879\\C57.exe" 3xiv.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /t" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /G" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /J" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /W" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /c" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /Z" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /D" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /v" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /U" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /B" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /X" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /u" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /p" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /N" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /O" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /K" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /S" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /w" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /b" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /e" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /R" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /T" mevit.exe Set value (str) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mevit = "C:\\Users\\Admin\\mevit.exe /A" mevit.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3328 set thread context of 1912 3328 2xiv.exe 85 - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\4879\C57.exe 3xiv.exe File opened for modification C:\Program Files (x86)\LP\4879\A7C4.tmp 3xiv.exe File opened for modification C:\Program Files (x86)\LP\4879\C57.exe 3xiv.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe - Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 4948 tasklist.exe 3008 tasklist.exe - Modifies registry class 10 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2971393436-602173351-1645505021-1000\{E04FE4AD-706C-42B9-A0D6-CAB7252F2CB0} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3368 x276Ht.exe 3368 x276Ht.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 3368 x276Ht.exe 3368 x276Ht.exe 4248 mevit.exe 4248 mevit.exe 1912 2xiv.exe 1912 2xiv.exe 4248 mevit.exe 4248 mevit.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 4248 mevit.exe 4248 mevit.exe 4248 mevit.exe 4248 mevit.exe 4248 mevit.exe 4248 mevit.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 4248 mevit.exe 4248 mevit.exe 1912 2xiv.exe 1912 2xiv.exe 4248 mevit.exe 4248 mevit.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 1912 2xiv.exe 4248 mevit.exe 4248 mevit.exe 1912 2xiv.exe 1912 2xiv.exe 4248 mevit.exe 4248 mevit.exe 1912 2xiv.exe 1912 2xiv.exe 4248 mevit.exe 4248 mevit.exe 1912 2xiv.exe 1912 2xiv.exe 4248 mevit.exe 4248 mevit.exe 1912 2xiv.exe 1912 2xiv.exe 3212 3xiv.exe 3212 3xiv.exe 3212 3xiv.exe 3212 3xiv.exe - Suspicious use of AdjustPrivilegeToken 15 IoCs
description pid Process Token: SeDebugPrivilege 4948 tasklist.exe Token: SeSecurityPrivilege 3616 msiexec.exe Token: SeDebugPrivilege 3848 4xiv.exe Token: SeDebugPrivilege 3848 4xiv.exe Token: SeShutdownPrivilege 764 explorer.exe Token: SeCreatePagefilePrivilege 764 explorer.exe Token: SeShutdownPrivilege 764 explorer.exe Token: SeCreatePagefilePrivilege 764 explorer.exe Token: SeShutdownPrivilege 764 explorer.exe Token: SeCreatePagefilePrivilege 764 explorer.exe Token: SeShutdownPrivilege 764 explorer.exe Token: SeCreatePagefilePrivilege 764 explorer.exe Token: SeShutdownPrivilege 764 explorer.exe Token: SeCreatePagefilePrivilege 764 explorer.exe Token: SeDebugPrivilege 3008 tasklist.exe - Suspicious use of FindShellTrayWindow 9 IoCs
pid Process 764 explorer.exe 764 explorer.exe 764 explorer.exe 764 explorer.exe 764 explorer.exe 764 explorer.exe 764 explorer.exe 764 explorer.exe 764 explorer.exe - Suspicious use of SendNotifyMessage 10 IoCs
pid Process 764 explorer.exe 764 explorer.exe 764 explorer.exe 764 explorer.exe 764 explorer.exe 764 explorer.exe 764 explorer.exe 764 explorer.exe 764 explorer.exe 764 explorer.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 3368 x276Ht.exe 3328 2xiv.exe 4248 mevit.exe 2120 5xiv.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1664 wrote to memory of 3368 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 82 PID 1664 wrote to memory of 3368 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 82 PID 1664 wrote to memory of 3368 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 82 PID 1664 wrote to memory of 3328 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 84 PID 1664 wrote to memory of 3328 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 84 PID 1664 wrote to memory of 3328 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 84 PID 3328 wrote to memory of 1912 3328 2xiv.exe 85 PID 3328 wrote to memory of 1912 3328 2xiv.exe 85 PID 3328 wrote to memory of 1912 3328 2xiv.exe 85 PID 3328 wrote to memory of 1912 3328 2xiv.exe 85 PID 3328 wrote to memory of 1912 3328 2xiv.exe 85 PID 3328 wrote to memory of 1912 3328 2xiv.exe 85 PID 3328 wrote to memory of 1912 3328 2xiv.exe 85 PID 3328 wrote to memory of 1912 3328 2xiv.exe 85 PID 1664 wrote to memory of 3212 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 86 PID 1664 wrote to memory of 3212 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 86 PID 1664 wrote to memory of 3212 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 86 PID 3368 wrote to memory of 4248 3368 x276Ht.exe 87 PID 3368 wrote to memory of 4248 3368 x276Ht.exe 87 PID 3368 wrote to memory of 4248 3368 x276Ht.exe 87 PID 3368 wrote to memory of 4988 3368 x276Ht.exe 88 PID 3368 wrote to memory of 4988 3368 x276Ht.exe 88 PID 3368 wrote to memory of 4988 3368 x276Ht.exe 88 PID 4988 wrote to memory of 4948 4988 cmd.exe 90 PID 4988 wrote to memory of 4948 4988 cmd.exe 90 PID 4988 wrote to memory of 4948 4988 cmd.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 4248 wrote to memory of 4948 4248 mevit.exe 90 PID 1664 wrote to memory of 3848 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 96 PID 1664 wrote to memory of 3848 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 96 PID 1664 wrote to memory of 3848 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 96 PID 3848 wrote to memory of 3452 3848 4xiv.exe 101 PID 3848 wrote to memory of 3452 3848 4xiv.exe 101 PID 3452 wrote to memory of 4888 3452 X 103 PID 3452 wrote to memory of 4888 3452 X 103 PID 3452 wrote to memory of 4888 3452 X 103 PID 3212 wrote to memory of 3968 3212 3xiv.exe 104 PID 3212 wrote to memory of 3968 3212 3xiv.exe 104 PID 3212 wrote to memory of 3968 3212 3xiv.exe 104 PID 1664 wrote to memory of 2120 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 106 PID 1664 wrote to memory of 2120 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 106 PID 1664 wrote to memory of 2120 1664 a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe 106 PID 3212 wrote to memory of 848 3212 3xiv.exe 107 PID 3212 wrote to memory of 848 3212 3xiv.exe 107 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 3xiv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 3xiv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe"C:\Users\Admin\AppData\Local\Temp\a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\x276Ht.exeC:\Users\Admin\x276Ht.exe2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368 -
C:\Users\Admin\mevit.exe"C:\Users\Admin\mevit.exe"3⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del x276Ht.exe3⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4948
-
-
-
-
C:\Users\Admin\2xiv.exeC:\Users\Admin\2xiv.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Users\Admin\2xiv.exe"C:\Users\Admin\2xiv.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1912
-
-
-
C:\Users\Admin\3xiv.exeC:\Users\Admin\3xiv.exe2⤵
- Modifies security service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3212 -
C:\Users\Admin\3xiv.exeC:\Users\Admin\3xiv.exe startC:\Users\Admin\AppData\Roaming\9272C\E3148.exe%C:\Users\Admin\AppData\Roaming\9272C3⤵
- Executes dropped EXE
PID:3968
-
-
C:\Program Files (x86)\LP\4879\A7C4.tmp"C:\Program Files (x86)\LP\4879\A7C4.tmp"3⤵
- Executes dropped EXE
PID:848
-
-
C:\Users\Admin\3xiv.exeC:\Users\Admin\3xiv.exe startC:\Program Files (x86)\2CEAE\lvvm.exe%C:\Program Files (x86)\2CEAE3⤵
- Executes dropped EXE
PID:2116
-
-
-
C:\Users\Admin\4xiv.exeC:\Users\Admin\4xiv.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\ebe732ad\X*0*bc*afc09703*31.193.3.240:533⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"4⤵PID:4888
-
-
-
-
C:\Users\Admin\5xiv.exeC:\Users\Admin\5xiv.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2120
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del a103c5c6663bcccb2e9462539150c27b1ca8ff8a02880fb26902b627430f3169.exe2⤵PID:3680
-
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3616
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:764
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2688
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵PID:4312
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\LP\4879\A7C4.tmp
- Size 101KB
- SHA256 86725431a4d0a9b52b5be71853baac7bc228b5ce92443e758a376ef7e7cbac5f
- MD5 8ddb300fe82a1e8ab0b0c9b704725316
- SHA1 899ef3abfa492136996ccffd0958e0c607817835
- SHA512 3a13663e34a65a6f255c973aeb4c2534adc386135d401b7274fd958c753e29116dc85f6736481593d8cdf7459dc65aa926de7d5b3a67db983730e36db146b321
- SSDEEP 1536:JXFhjUUgU4k1hsV1OsBkoM+NFmNfiN+5N9Vy2Cs78QmADQhKoNBse3J:JXF85uhIQoMemw+5NL570iS5se5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\LP\4879\A7C4.tmp
- Size 101KB
- SHA256 86725431a4d0a9b52b5be71853baac7bc228b5ce92443e758a376ef7e7cbac5f
- MD5 8ddb300fe82a1e8ab0b0c9b704725316
- SHA1 899ef3abfa492136996ccffd0958e0c607817835
- SHA512 3a13663e34a65a6f255c973aeb4c2534adc386135d401b7274fd958c753e29116dc85f6736481593d8cdf7459dc65aa926de7d5b3a67db983730e36db146b321
- SSDEEP 1536:JXFhjUUgU4k1hsV1OsBkoM+NFmNfiN+5N9Vy2Cs78QmADQhKoNBse3J:JXF85uhIQoMemw+5NL570iS5se5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\2xiv.exe
- Size 64KB
- SHA256 4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d
- MD5 930ddf5711ff276332bc5e1eec8cded0
- SHA1 e14b2bdd272fe546c043ab7a2f249955e1820744
- SHA512 3ca938a3bd51168445a50b4f823feb9db2eee5d7828e32cc90be64275b2702e8c3eba0cf8a4e9d5b1b7a17a4df8b7c627315a140bcd2f47e2b78e5e220ae4f6d
- SSDEEP 768:jfzr76kF1SuFI8hF3d7gizW/3MDzvaHiUwijkyR50G/B0GtC4/+9kuyzwlYiv7Rq://TF1Sw/W/cPSwXK+Kuyu9q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\2xiv.exe
- Size 64KB
- SHA256 4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d
- MD5 930ddf5711ff276332bc5e1eec8cded0
- SHA1 e14b2bdd272fe546c043ab7a2f249955e1820744
- SHA512 3ca938a3bd51168445a50b4f823feb9db2eee5d7828e32cc90be64275b2702e8c3eba0cf8a4e9d5b1b7a17a4df8b7c627315a140bcd2f47e2b78e5e220ae4f6d
- SSDEEP 768:jfzr76kF1SuFI8hF3d7gizW/3MDzvaHiUwijkyR50G/B0GtC4/+9kuyzwlYiv7Rq://TF1Sw/W/cPSwXK+Kuyu9q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\2xiv.exe
- Size 64KB
- SHA256 4ee9b7d064b411cbde34bb286e46d1d99112efe5f928420b4dc11a66d9b6839d
- MD5 930ddf5711ff276332bc5e1eec8cded0
- SHA1 e14b2bdd272fe546c043ab7a2f249955e1820744
- SHA512 3ca938a3bd51168445a50b4f823feb9db2eee5d7828e32cc90be64275b2702e8c3eba0cf8a4e9d5b1b7a17a4df8b7c627315a140bcd2f47e2b78e5e220ae4f6d
- SSDEEP 768:jfzr76kF1SuFI8hF3d7gizW/3MDzvaHiUwijkyR50G/B0GtC4/+9kuyzwlYiv7Rq://TF1Sw/W/cPSwXK+Kuyu9q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\3xiv.exe
- Size 287KB
- SHA256 b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e
- MD5 3d6f651187a05dfab030fd923b218279
- SHA1 9d0fff6e4d22777a9f3b7c57baea9f34151eca65
- SHA512 835cc4eb247e6bdaefef37546922c902a448eb9de32432f59c0b7a9c524a07abfa10d23ad3fd5f3d8897e821f95d73849b5ef8053ace3d480d76720e7d10acbd
- SSDEEP 6144:F5OXfPdaXaZnhlHtJ2L5apxzB0NPXQwO1SGF8D56OZ4QsdJj9W2g7gVa:FUvPIXaFDtwL5YpB0Vm1SgC6OZ4QsdJ+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\3xiv.exe
- Size 287KB
- SHA256 b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e
- MD5 3d6f651187a05dfab030fd923b218279
- SHA1 9d0fff6e4d22777a9f3b7c57baea9f34151eca65
- SHA512 835cc4eb247e6bdaefef37546922c902a448eb9de32432f59c0b7a9c524a07abfa10d23ad3fd5f3d8897e821f95d73849b5ef8053ace3d480d76720e7d10acbd
- SSDEEP 6144:F5OXfPdaXaZnhlHtJ2L5apxzB0NPXQwO1SGF8D56OZ4QsdJj9W2g7gVa:FUvPIXaFDtwL5YpB0Vm1SgC6OZ4QsdJ+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\3xiv.exe
- Size 287KB
- SHA256 b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e
- MD5 3d6f651187a05dfab030fd923b218279
- SHA1 9d0fff6e4d22777a9f3b7c57baea9f34151eca65
- SHA512 835cc4eb247e6bdaefef37546922c902a448eb9de32432f59c0b7a9c524a07abfa10d23ad3fd5f3d8897e821f95d73849b5ef8053ace3d480d76720e7d10acbd
- SSDEEP 6144:F5OXfPdaXaZnhlHtJ2L5apxzB0NPXQwO1SGF8D56OZ4QsdJj9W2g7gVa:FUvPIXaFDtwL5YpB0Vm1SgC6OZ4QsdJ+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\3xiv.exe
- Size 287KB
- SHA256 b0c28bc12dc7dfe527283d315605e01f8a3b282f1e877a3bcf78b3ca35f72f3e
- MD5 3d6f651187a05dfab030fd923b218279
- SHA1 9d0fff6e4d22777a9f3b7c57baea9f34151eca65
- SHA512 835cc4eb247e6bdaefef37546922c902a448eb9de32432f59c0b7a9c524a07abfa10d23ad3fd5f3d8897e821f95d73849b5ef8053ace3d480d76720e7d10acbd
- SSDEEP 6144:F5OXfPdaXaZnhlHtJ2L5apxzB0NPXQwO1SGF8D56OZ4QsdJj9W2g7gVa:FUvPIXaFDtwL5YpB0Vm1SgC6OZ4QsdJ+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\4xiv.exe
- Size 265KB
- SHA256 c31f65ef14f409c290bb661077f8473bf0a2de47e08d0256c1f086556b50ab79
- MD5 45cba518c7a8b41f65690da873e13e3d
- SHA1 5a787a1f7f7bdd22c72b0f9d26818d902b65da8b
- SHA512 7515485b6d9e90cf4dd00b076c4173f19adffe0215d95edadd4ceb61b46a06c3751aa524c70a3cac738b751bc73802877ef2d16a44b5cc0399c3e85b704249f7
- SSDEEP 6144:m+lXbW+BfrEIsEreTDA91yXOPr92odusI3F/tRSdKb:3lrPlEIsIussM96fRS0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\4xiv.exe
- Size 265KB
- SHA256 c31f65ef14f409c290bb661077f8473bf0a2de47e08d0256c1f086556b50ab79
- MD5 45cba518c7a8b41f65690da873e13e3d
- SHA1 5a787a1f7f7bdd22c72b0f9d26818d902b65da8b
- SHA512 7515485b6d9e90cf4dd00b076c4173f19adffe0215d95edadd4ceb61b46a06c3751aa524c70a3cac738b751bc73802877ef2d16a44b5cc0399c3e85b704249f7
- SSDEEP 6144:m+lXbW+BfrEIsEreTDA91yXOPr92odusI3F/tRSdKb:3lrPlEIsIussM96fRS0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\5xiv.exe
- Size 44KB
- SHA256 7cf1fcac1a66a68e71346d784a0fe68aca36f15425c3c44a9a6eb60241617e18
- MD5 fd4f97e710556c5769ab1e074a5c02b5
- SHA1 eaac335c1dd2cd449f4d3b4f9b5cdad0cffa6d61
- SHA512 6f01d7a97497d245cf4144fac30cd169435ad51ea432adf2469e822773c529ff08daf0ffdca80c1aab607490b9f8f7cd06e08f6219c0065b58a773d42c159726
- SSDEEP 384:SYp9ojcqXbGDlNm3lj3yGyZIF/wHAbxttyXxnnrDw4wf:S0OVrGDlM1TTLFoqe1Bw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\5xiv.exe
- Size 44KB
- SHA256 7cf1fcac1a66a68e71346d784a0fe68aca36f15425c3c44a9a6eb60241617e18
- MD5 fd4f97e710556c5769ab1e074a5c02b5
- SHA1 eaac335c1dd2cd449f4d3b4f9b5cdad0cffa6d61
- SHA512 6f01d7a97497d245cf4144fac30cd169435ad51ea432adf2469e822773c529ff08daf0ffdca80c1aab607490b9f8f7cd06e08f6219c0065b58a773d42c159726
- SSDEEP 384:SYp9ojcqXbGDlNm3lj3yGyZIF/wHAbxttyXxnnrDw4wf:S0OVrGDlM1TTLFoqe1Bw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\ebe732ad\X
- Size 38KB
- SHA256 c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
- MD5 72de2dadaf875e2fd7614e100419033c
- SHA1 5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
- SHA512 e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
- SSDEEP 768:q+w+Ehg1B3o5F+Q4SA4GXEcsQiHh9IS+OiDdSmvx3XlsClJg:SNW1B3W4SGOQwOSqFXlsCXg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\ebe732ad\X
- Size 38KB
- SHA256 c44993768a4dc5a58ddbfc9cb05ce2a7d3a0a56be45643d70a72bcf811b6c381
- MD5 72de2dadaf875e2fd7614e100419033c
- SHA1 5f17c5330e91a42daa9ff24c4aa602bd1a72bf6e
- SHA512 e2520a53326a7d3b056e65d0cf60e9d823ffb34ca026cdddc7ea3a714f8396c53c37e13a887fc86a7dd7076c97fdfad53c3f5a68342ebc1bdec948c76bda8df3
- SSDEEP 768:q+w+Ehg1B3o5F+Q4SA4GXEcsQiHh9IS+OiDdSmvx3XlsClJg:SNW1B3W4SGOQwOSqFXlsCXg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\mevit.exe
- Size 332KB
- SHA256 619e2dd2e3221231148039a6a97b164035afa4751517e6abf6b13460720281e9
- MD5 ee9a26f703131157eb0cb1eae9c9e655
- SHA1 b21bc923b45cd6ec10690c262140655e3f49eb07
- SHA512 7b99588bdbdcc44f7e5aa876a6061b19402b057df326b30a41e3ef146bd8bb4bb8b99b96b6b6a7e475757ab9206860fa9126532a643d667a2c52aa0f7048fe1c
- SSDEEP 6144:V1or73PuAuVxZS82fEbtYzjSCxBUg1KM6sYtEU:Vm/uVxZS8EDh3hU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\mevit.exe
- Size 332KB
- SHA256 619e2dd2e3221231148039a6a97b164035afa4751517e6abf6b13460720281e9
- MD5 ee9a26f703131157eb0cb1eae9c9e655
- SHA1 b21bc923b45cd6ec10690c262140655e3f49eb07
- SHA512 7b99588bdbdcc44f7e5aa876a6061b19402b057df326b30a41e3ef146bd8bb4bb8b99b96b6b6a7e475757ab9206860fa9126532a643d667a2c52aa0f7048fe1c
- SSDEEP 6144:V1or73PuAuVxZS82fEbtYzjSCxBUg1KM6sYtEU:Vm/uVxZS8EDh3hU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\x276Ht.exe
- Size 332KB
- SHA256 39c408d03296d3639563dfb51ee977fb508fc9fd4d005e6cad8551ea3f2f4fb0
- MD5 ad27bc021625bc7692f942a626b3a576
- SHA1 12d961ecb68e63c2cf3c3590da311a9bd5e521f7
- SHA512 2c51d8fe3cc5d2eb50d7cc5faf76f8b1d35380eb078409b1fa24caa9ca719d3b447d0669f07138330d360471a06bbc1dcca5e7a2eb81179af164a87a9f6b74bb
- SSDEEP 6144:HaorO3PuAuVxZS82fEbtYzjSCxBUg1KM6sWtEU:HU/uVxZS8EDh3TU
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\x276Ht.exe
- Size 332KB
- SHA256 39c408d03296d3639563dfb51ee977fb508fc9fd4d005e6cad8551ea3f2f4fb0
- MD5 ad27bc021625bc7692f942a626b3a576
- SHA1 12d961ecb68e63c2cf3c3590da311a9bd5e521f7
- SHA512 2c51d8fe3cc5d2eb50d7cc5faf76f8b1d35380eb078409b1fa24caa9ca719d3b447d0669f07138330d360471a06bbc1dcca5e7a2eb81179af164a87a9f6b74bb
- SSDEEP 6144:HaorO3PuAuVxZS82fEbtYzjSCxBUg1KM6sWtEU:HU/uVxZS8EDh3TU
- MD5 SHA1 SHA512 SSDEEP