Analysis
- max time kernel
141s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
21/11/2022, 00:21
Static task
static1
Behavioral task
behavioral1
Sample
0v3yT8.06.10.exe
Resource
win7-20220812-en
windows7-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
0v3yT8.06.10.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
22 signatures
150 seconds
General
- Target 0v3yT8.06.10.exe
- Size 2.4MB
- Sample221121-antabafb8z
- SHA256 08b82e2125b63ec97ed8fb9cbf829ca31935b8dfa2f67be4d686353570554281
- MD5 3fcf77ffa0763350a1df45ab3b89f26a
- SHA1 0431c506fb86f1813621bc0d09ba12389021cc6b
- SHA512 07568d02a3cddf5285cf3ea7ab4bc05fb3cc0739b4bd59c75bdf60f0950a52e4ecc2168f53d5f41031271716ecc8babd164e42007c1cdf9ba00e55124232b842
- SSDEEP 49152:wgwREifu1DBgutBPNbPz0F3SMzx5QPdqGbHpIAxKof9X7PID/n3ZkIe:wgwREvguPPxzsfTe8GbHjkofeD/n2z
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" system86.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 0v3yT8.06.10.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell 0v3yT8.06.10.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" 0v3yT8.06.10.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 0v3yT8.06.10.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command 0v3yT8.06.10.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open 0v3yT8.06.10.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command system86.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" system86.exe - Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
pid Process 2380 bcdedit.exe 2568 bcdedit.exe -
pid Process 2192 wbadmin.exe -
pid Process 4012 wbadmin.exe - Executes dropped EXE 10 IoCs
pid Process 1472 7za.exe 380 7za.exe 1484 0v3yT8.06.10.exe 4612 system86.exe 3512 DC.exe 3200 system86.exe 2804 system86.exe 1780 system86.exe 1920 Everything.exe 2124 Everything.exe - Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SelectEnable.crw.0v3yT8 system86.exe File renamed C:\Users\Admin\Pictures\TestSave.tif => C:\Users\Admin\Pictures\TestSave.tif.0v3yT8 system86.exe File renamed C:\Users\Admin\Pictures\PopDismount.png => C:\Users\Admin\Pictures\PopDismount.png.0v3yT8 system86.exe File opened for modification C:\Users\Admin\Pictures\PopDismount.png.0v3yT8 system86.exe File renamed C:\Users\Admin\Pictures\FindExport.crw => C:\Users\Admin\Pictures\FindExport.crw.0v3yT8 system86.exe File renamed C:\Users\Admin\Pictures\SelectEnable.crw => C:\Users\Admin\Pictures\SelectEnable.crw.0v3yT8 system86.exe File renamed C:\Users\Admin\Pictures\DismountSkip.raw => C:\Users\Admin\Pictures\DismountSkip.raw.0v3yT8 system86.exe File opened for modification C:\Users\Admin\Pictures\DismountSkip.raw.0v3yT8 system86.exe File opened for modification C:\Users\Admin\Pictures\TestSave.tif.0v3yT8 system86.exe File opened for modification C:\Users\Admin\Pictures\FindExport.crw.0v3yT8 system86.exe - Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBIDPService.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sql.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CompatTelRunner.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\benetns.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Creative Cloud.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vxmon.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsDtSrvr.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ocomm.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wpython.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xfssvccon.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchIndexer.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pvlsvr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqbcoreservice.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Sysmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tbirdconfig.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agntsvc.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdlauncher.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\isqlplussvc.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlagent.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tv_w32.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wxServerView.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tasklist.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dbeng50.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mysqld-opt.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fbserver.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TeamViewer_Service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgrN.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VeeamDeploymentSvc.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsqmcons.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bedbh.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oracle.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Raccine.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sqlbrowser.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsa_service.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SearchProtocolHost.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shutdown.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutodeskDesktopApp.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBDBMgr.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QBW64.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\python.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RaccineSettings.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RAgui.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tomcat6.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wdswfsafe.exe system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bengien.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\java.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "C:\\Windows\\System32\\Systray.exe" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fdhost.exe system86.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 0v3yT8.06.10.exe - Loads dropped DLL 5 IoCs
pid Process 1484 0v3yT8.06.10.exe 4612 system86.exe 3200 system86.exe 2804 system86.exe 1780 system86.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0v3yT8.06.10.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system86 = "\"C:\\Users\\Admin\\AppData\\Local\\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\\system86.exe\" " 0v3yT8.06.10.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system86.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\Q: Everything.exe File opened (read-only) \??\E: system86.exe File opened (read-only) \??\G: system86.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\V: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\J: Everything.exe File opened (read-only) \??\E: Everything.exe File opened (read-only) \??\V: system86.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\H: system86.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\B: system86.exe File opened (read-only) \??\J: system86.exe File opened (read-only) \??\M: system86.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\A: system86.exe File opened (read-only) \??\R: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\H: Everything.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\O: Everything.exe File opened (read-only) \??\U: Everything.exe File opened (read-only) \??\Z: Everything.exe File opened (read-only) \??\N: system86.exe File opened (read-only) \??\T: system86.exe File opened (read-only) \??\O: system86.exe File opened (read-only) \??\L: Everything.exe File opened (read-only) \??\A: Everything.exe File opened (read-only) \??\T: Everything.exe File opened (read-only) \??\X: Everything.exe File opened (read-only) \??\K: system86.exe File opened (read-only) \??\X: system86.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\N: Everything.exe File opened (read-only) \??\L: system86.exe File opened (read-only) \??\W: system86.exe File opened (read-only) \??\F: Everything.exe File opened (read-only) \??\G: Everything.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\F: Everything.exe File opened (read-only) \??\F: system86.exe File opened (read-only) \??\P: system86.exe File opened (read-only) \??\M: Everything.exe File opened (read-only) \??\P: Everything.exe File opened (read-only) \??\S: Everything.exe File opened (read-only) \??\Q: system86.exe File opened (read-only) \??\R: system86.exe File opened (read-only) \??\S: system86.exe File opened (read-only) \??\Y: system86.exe File opened (read-only) \??\I: Everything.exe File opened (read-only) \??\W: Everything.exe File opened (read-only) \??\U: system86.exe File opened (read-only) \??\Y: Everything.exe File opened (read-only) \??\I: system86.exe File opened (read-only) \??\Z: system86.exe File opened (read-only) \??\B: Everything.exe File opened (read-only) \??\L: Everything.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName vds.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000 vds.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName vds.exe - Modifies registry class 19 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell 0v3yT8.06.10.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open 0v3yT8.06.10.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command\ = "notepad.exe \"C:\\Users\\Admin\\AppData\\Local\\How-to-decrypt.txt\"" system86.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 0v3yT8.06.10.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command 0v3yT8.06.10.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command system86.exe Key created \REGISTRY\MACHINE\Software\Classes\mimicfile\shell\open\command system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.0v3yT8\ = "mimicfile" system86.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" system86.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mimicfile\shell\open\command system86.exe Key created \REGISTRY\MACHINE\Software\Classes\.0v3yT8 system86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 0v3yT8.06.10.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile 0v3yT8.06.10.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\exefile\shell\open\command\ = "\"%1\" %*" 0v3yT8.06.10.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2804 system86.exe 2804 system86.exe 1780 system86.exe 1780 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 1004 powershell.exe 972 powershell.exe 1004 powershell.exe 3800 powershell.exe 972 powershell.exe 3800 powershell.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe 4612 system86.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 1472 7za.exe Token: 35 1472 7za.exe Token: SeRestorePrivilege 380 7za.exe Token: 35 380 7za.exe Token: SeSecurityPrivilege 380 7za.exe Token: SeSecurityPrivilege 380 7za.exe Token: SeIncreaseQuotaPrivilege 1484 0v3yT8.06.10.exe Token: SeSecurityPrivilege 1484 0v3yT8.06.10.exe Token: SeTakeOwnershipPrivilege 1484 0v3yT8.06.10.exe Token: SeLoadDriverPrivilege 1484 0v3yT8.06.10.exe Token: SeSystemProfilePrivilege 1484 0v3yT8.06.10.exe Token: SeSystemtimePrivilege 1484 0v3yT8.06.10.exe Token: SeProfSingleProcessPrivilege 1484 0v3yT8.06.10.exe Token: SeIncBasePriorityPrivilege 1484 0v3yT8.06.10.exe Token: SeCreatePagefilePrivilege 1484 0v3yT8.06.10.exe Token: SeBackupPrivilege 1484 0v3yT8.06.10.exe Token: SeRestorePrivilege 1484 0v3yT8.06.10.exe Token: SeShutdownPrivilege 1484 0v3yT8.06.10.exe Token: SeDebugPrivilege 1484 0v3yT8.06.10.exe Token: SeSystemEnvironmentPrivilege 1484 0v3yT8.06.10.exe Token: SeChangeNotifyPrivilege 1484 0v3yT8.06.10.exe Token: SeRemoteShutdownPrivilege 1484 0v3yT8.06.10.exe Token: SeUndockPrivilege 1484 0v3yT8.06.10.exe Token: SeManageVolumePrivilege 1484 0v3yT8.06.10.exe Token: SeImpersonatePrivilege 1484 0v3yT8.06.10.exe Token: SeCreateGlobalPrivilege 1484 0v3yT8.06.10.exe Token: 33 1484 0v3yT8.06.10.exe Token: 34 1484 0v3yT8.06.10.exe Token: 35 1484 0v3yT8.06.10.exe Token: 36 1484 0v3yT8.06.10.exe Token: SeIncreaseQuotaPrivilege 4612 system86.exe Token: SeSecurityPrivilege 4612 system86.exe Token: SeTakeOwnershipPrivilege 4612 system86.exe Token: SeLoadDriverPrivilege 4612 system86.exe Token: SeSystemProfilePrivilege 4612 system86.exe Token: SeSystemtimePrivilege 4612 system86.exe Token: SeProfSingleProcessPrivilege 4612 system86.exe Token: SeIncBasePriorityPrivilege 4612 system86.exe Token: SeCreatePagefilePrivilege 4612 system86.exe Token: SeBackupPrivilege 4612 system86.exe Token: SeRestorePrivilege 4612 system86.exe Token: SeShutdownPrivilege 4612 system86.exe Token: SeDebugPrivilege 4612 system86.exe Token: SeSystemEnvironmentPrivilege 4612 system86.exe Token: SeChangeNotifyPrivilege 4612 system86.exe Token: SeRemoteShutdownPrivilege 4612 system86.exe Token: SeUndockPrivilege 4612 system86.exe Token: SeManageVolumePrivilege 4612 system86.exe Token: SeImpersonatePrivilege 4612 system86.exe Token: SeCreateGlobalPrivilege 4612 system86.exe Token: 33 4612 system86.exe Token: 34 4612 system86.exe Token: 35 4612 system86.exe Token: 36 4612 system86.exe Token: SeIncreaseQuotaPrivilege 2804 system86.exe Token: SeSecurityPrivilege 2804 system86.exe Token: SeTakeOwnershipPrivilege 2804 system86.exe Token: SeIncreaseQuotaPrivilege 3200 system86.exe Token: SeSecurityPrivilege 3200 system86.exe Token: SeTakeOwnershipPrivilege 3200 system86.exe Token: SeLoadDriverPrivilege 2804 system86.exe Token: SeLoadDriverPrivilege 3200 system86.exe Token: SeSystemProfilePrivilege 3200 system86.exe Token: SeSystemProfilePrivilege 2804 system86.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1920 Everything.exe 2124 Everything.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4660 wrote to memory of 1472 4660 0v3yT8.06.10.exe 82 PID 4660 wrote to memory of 1472 4660 0v3yT8.06.10.exe 82 PID 4660 wrote to memory of 1472 4660 0v3yT8.06.10.exe 82 PID 4660 wrote to memory of 380 4660 0v3yT8.06.10.exe 84 PID 4660 wrote to memory of 380 4660 0v3yT8.06.10.exe 84 PID 4660 wrote to memory of 380 4660 0v3yT8.06.10.exe 84 PID 4660 wrote to memory of 1484 4660 0v3yT8.06.10.exe 86 PID 4660 wrote to memory of 1484 4660 0v3yT8.06.10.exe 86 PID 4660 wrote to memory of 1484 4660 0v3yT8.06.10.exe 86 PID 1484 wrote to memory of 4612 1484 0v3yT8.06.10.exe 91 PID 1484 wrote to memory of 4612 1484 0v3yT8.06.10.exe 91 PID 1484 wrote to memory of 4612 1484 0v3yT8.06.10.exe 91 PID 4612 wrote to memory of 4944 4612 system86.exe 94 PID 4612 wrote to memory of 4944 4612 system86.exe 94 PID 4612 wrote to memory of 4944 4612 system86.exe 94 PID 4944 wrote to memory of 3512 4944 cmd.exe 96 PID 4944 wrote to memory of 3512 4944 cmd.exe 96 PID 4944 wrote to memory of 3512 4944 cmd.exe 96 PID 4612 wrote to memory of 3200 4612 system86.exe 97 PID 4612 wrote to memory of 3200 4612 system86.exe 97 PID 4612 wrote to memory of 3200 4612 system86.exe 97 PID 4612 wrote to memory of 2804 4612 system86.exe 99 PID 4612 wrote to memory of 2804 4612 system86.exe 99 PID 4612 wrote to memory of 2804 4612 system86.exe 99 PID 4612 wrote to memory of 1780 4612 system86.exe 100 PID 4612 wrote to memory of 1780 4612 system86.exe 100 PID 4612 wrote to memory of 1780 4612 system86.exe 100 PID 4612 wrote to memory of 1920 4612 system86.exe 103 PID 4612 wrote to memory of 1920 4612 system86.exe 103 PID 4612 wrote to memory of 1920 4612 system86.exe 103 PID 4612 wrote to memory of 1260 4612 system86.exe 119 PID 4612 wrote to memory of 1260 4612 system86.exe 119 PID 4612 wrote to memory of 4944 4612 system86.exe 140 PID 4612 wrote to memory of 4944 4612 system86.exe 140 PID 4612 wrote to memory of 5088 4612 system86.exe 139 PID 4612 wrote to memory of 5088 4612 system86.exe 139 PID 4612 wrote to memory of 3772 4612 system86.exe 138 PID 4612 wrote to memory of 3772 4612 system86.exe 138 PID 4612 wrote to memory of 2060 4612 system86.exe 128 PID 4612 wrote to memory of 2060 4612 system86.exe 128 PID 4612 wrote to memory of 4584 4612 system86.exe 122 PID 4612 wrote to memory of 4584 4612 system86.exe 122 PID 4612 wrote to memory of 4852 4612 system86.exe 123 PID 4612 wrote to memory of 4852 4612 system86.exe 123 PID 4612 wrote to memory of 4664 4612 system86.exe 124 PID 4612 wrote to memory of 4664 4612 system86.exe 124 PID 4612 wrote to memory of 996 4612 system86.exe 129 PID 4612 wrote to memory of 996 4612 system86.exe 129 PID 4612 wrote to memory of 1972 4612 system86.exe 134 PID 4612 wrote to memory of 1972 4612 system86.exe 134 PID 4612 wrote to memory of 1180 4612 system86.exe 130 PID 4612 wrote to memory of 1180 4612 system86.exe 130 PID 4612 wrote to memory of 2656 4612 system86.exe 131 PID 4612 wrote to memory of 2656 4612 system86.exe 131 PID 4612 wrote to memory of 3812 4612 system86.exe 141 PID 4612 wrote to memory of 3812 4612 system86.exe 141 PID 4612 wrote to memory of 872 4612 system86.exe 153 PID 4612 wrote to memory of 872 4612 system86.exe 153 PID 4612 wrote to memory of 5096 4612 system86.exe 143 PID 4612 wrote to memory of 5096 4612 system86.exe 143 PID 4612 wrote to memory of 3800 4612 system86.exe 144 PID 4612 wrote to memory of 3800 4612 system86.exe 144 PID 4612 wrote to memory of 1004 4612 system86.exe 145 PID 4612 wrote to memory of 1004 4612 system86.exe 145 - System policy modification 1 TTPs 11 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" system86.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HidePowerOptions = "1" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0" system86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0" system86.exe Key created \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\Windows\CurrentVersion\Policies\System system86.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0v3yT8.06.10.exe"C:\Users\Admin\AppData\Local\Temp\0v3yT8.06.10.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" i2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1472
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe" x -y -p933916544411611201 Everything64.dll2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:380
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0v3yT8.06.10.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0v3yT8.06.10.exe"2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe"3⤵
- Modifies system executable filetype association
- UAC bypass
- Executes dropped EXE
- Modifies extensions of user files
- Sets file execution options in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4612 -
C:\Windows\SysWOW64\cmd.execmd.exe /c DC.exe /D4⤵
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\DC.exeDC.exe /D5⤵
- Executes dropped EXE
PID:3512
-
-
-
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe" -e watch -pid 4612 -!4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3200
-
-
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe" -e ul14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe" -e ul24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1780
-
-
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:1920
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -H off4⤵PID:1260
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:4584
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:4852
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:4664
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:2060
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:996
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:1180
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:2656
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:1972
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:3772
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 96996bc0-ad50-47ec-923b-6f41874dd9eb 04⤵PID:5088
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 4f971e89-eebd-4455-a8de-9e59040e7347 7648efa3-dd9c-4e3e-b566-50f929386280 04⤵PID:4944
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -SETDCVALUEINDEX e9a42b02-d5df-448d-aa00-03f14749eb61 4f971e89-eebd-4455-a8de-9e59040e7347 5ca83367-6e45-459f-a27b-476b1d01c936 04⤵PID:3812
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S e9a42b02-d5df-448d-aa00-03f14749eb614⤵PID:5096
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Stop-VM"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:3800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-VM | Select-Object vmid | Get-VHD | %{Get-DiskImage -ImagePath $_.Path; Get-DiskImage -ImagePath $_.ParentPath} | Dismount-DiskImage"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1004
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass "Get-Volume | Get-DiskImage | Dismount-DiskImage"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:972
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg.exe -S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c4⤵PID:872
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} bootstatuspolicy ignoreallfailures4⤵
- Modifies boot configuration data using bcdedit
PID:2380
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit.exe /set {default} recoveryenabled no4⤵
- Modifies boot configuration data using bcdedit
PID:2568
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe delete catalog -quiet4⤵
- Deletes backup catalog
PID:4012
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin.exe DELETE SYSTEMSTATEBACKUP4⤵
- Deletes System State backups
- Drops file in Windows directory
PID:2192
-
-
C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe"C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe" -startup4⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
PID:2124
-
-
-
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:816
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4232
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3140
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3316
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4264
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:2172
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:640
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:4344
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1800
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3372
-
C:\Windows\System32\Systray.exeC:\Windows\System32\Systray.exe "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:1996
-
C:\Windows\system32\notepad.exe"notepad.exe" "C:\Users\Admin\AppData\Local\How-to-decrypt.txt"1⤵PID:4268
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:3140
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵PID:2460
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵PID:3872
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
PID:3848
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\How-to-decrypt.txt
- Size 1KB
- SHA256 5342e7adbbaad25538bef62eeb08984939e5da983512a455114429753df5e989
- MD5 cb7ad438670eae537f6160bd6bede7b0
- SHA1 fe90fc1ed86ac74d35cd88a20208a55f4f336268
- SHA512 aaeaf9a7d2f134ea2886e531d576fa12b715351ad05a73c192ebd5629dddbf6a20c7398d04491db8abf32475773d64567169f15b135912a3701e37978175820a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
- MD5 d85ba6ff808d9e5444a4b369f5bc2730
- SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
- SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
- MD5 d28a889fd956d5cb3accfbaf1143eb6f
- SHA1 157ba54b365341f8ff06707d996b3635da8446f7
- SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 09dd73f04765551a00bc3e4767fe5a7c05ad6bbf155a7ab41c04384b7db851ef
- MD5 755e01dde3ca995ae926b19c20d1cf27
- SHA1 f36ff7aed1cb8b099559e25f74abf2f70b66d3dd
- SHA512 9306964f08e81f8867cd370c5c090f8ed9fb0f5ac791c795968091dd9eb5fbb52854e757ea71925c34071feae202405d942d710f08ded49206255b2542051d4f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0v3yT8.06.10.exe
- Size 2.0MB
- SHA256 a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e
- MD5 6d081da0c4ea3eff0e18d414047bb5fd
- SHA1 992fca17ad2fe4a6523c3858c87b0e5203628032
- SHA512 12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7
- SSDEEP 24576:w/iIzkQF+KpPnF1Fx+CszLyQ9lkxIQVki//47JhUhio7Z6OI93lGFtPtnNON+Ijo:whBPrElwNkto7VINlGFtPtnwjjOaW/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\0v3yT8.06.10.exe
- Size 2.0MB
- SHA256 a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e
- MD5 6d081da0c4ea3eff0e18d414047bb5fd
- SHA1 992fca17ad2fe4a6523c3858c87b0e5203628032
- SHA512 12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7
- SSDEEP 24576:w/iIzkQF+KpPnF1Fx+CszLyQ9lkxIQVki//47JhUhio7Z6OI93lGFtPtnNON+Ijo:whBPrElwNkto7VINlGFtPtnwjjOaW/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
- Size 772KB
- SHA256 ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
- MD5 b93eb0a48c91a53bda6a1a074a4b431e
- SHA1 ac693a14c697b1a8ee80318e260e817b8ee2aa86
- SHA512 732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
- SSDEEP 24576:DFhjj7f4K+ao308d0ORMz27R0iIdclDJiD:JlwpP90OFWxD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
- Size 772KB
- SHA256 ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
- MD5 b93eb0a48c91a53bda6a1a074a4b431e
- SHA1 ac693a14c697b1a8ee80318e260e817b8ee2aa86
- SHA512 732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
- SSDEEP 24576:DFhjj7f4K+ao308d0ORMz27R0iIdclDJiD:JlwpP90OFWxD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\7za.exe
- Size 772KB
- SHA256 ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
- MD5 b93eb0a48c91a53bda6a1a074a4b431e
- SHA1 ac693a14c697b1a8ee80318e260e817b8ee2aa86
- SHA512 732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
- SSDEEP 24576:DFhjj7f4K+ao308d0ORMz27R0iIdclDJiD:JlwpP90OFWxD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DC.exe
- Size 802KB
- SHA256 c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
- MD5 ac34ba84a5054cd701efad5dd14645c9
- SHA1 dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
- SHA512 df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
- SSDEEP 12288:NaWzgMg7v3qnCiPErQohh0F4uCJ8lnyIQJ9QudhzYOekDXiGt8PSmQ:MaHMv6CrrjSnyIQ8+ekGA8PSmQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.exe
- Size 1.7MB
- SHA256 4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
- MD5 c44487ce1827ce26ac4699432d15b42a
- SHA1 8434080fad778057a50607364fee8b481f0feef8
- SHA512 a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
- SSDEEP 49152:sVzyP4BTkT3EApTLi2CCzMn3jzjAhFEy+eaXr:sVzyABTwEH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything.ini
- Size 548B
- SHA256 2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
- MD5 742c2400f2de964d0cce4a8dabadd708
- SHA1 c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
- SHA512 63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything2.ini
- Size 550B
- SHA256 89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
- MD5 51014c0c06acdd80f9ae4469e7d30a9e
- SHA1 204e6a57c44242fad874377851b13099dfe60176
- SHA512 79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll
- Size 84KB
- SHA256 8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
- MD5 3b03324537327811bbbaff4aafa4d75b
- SHA1 1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
- SHA512 ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
- SSDEEP 768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything32.dll
- Size 84KB
- SHA256 8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
- MD5 3b03324537327811bbbaff4aafa4d75b
- SHA1 1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
- SHA512 ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
- SSDEEP 768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Everything64.dll
- Size 1.5MB
- SHA256 1e077fc068b060e4356876e29ce01fd63598f1579a841336f4a30f73eda1f328
- MD5 c73353f0e0abf5ca18a10a268aefdb68
- SHA1 36887b5890bbd753f9556476ddb376208fe195fb
- SHA512 212546b076b59867ecf67b4cb060789b23ec9c167d0f0b311581ce272bb261cb4f8d8540fae3311fd3059906464214defb3cb3415fcf4769bfbe4e6bbaf4ad63
- SSDEEP 24576:6MFPWn0FIsS/i7IEWnXV59+lddNdnrbfp1RSdfFhxuhe4fJ5OGEI1rv1trFIAy/p:xPY0FFS6el5QPdbrbx1K7xI5RwhmtIAu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sdel.exe
- Size 350KB
- SHA256 e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
- MD5 803df907d936e08fbbd06020c411be93
- SHA1 4aa4b498ae037a2b0479659374a5c3af5f6b8d97
- SHA512 5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
- SSDEEP 6144:OBgL/kqXQangs2iKn5yvfj7wZxPzzLHrNJT7V:QgL5ga0iKn5GfPwZRT5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\sdel64.exe
- Size 448KB
- SHA256 5434dfdb731238edcb07a8c3a83594791536dda7a63c29f19be7bb1d59aedd60
- MD5 e2114b1627889b250c7fd0425ba1bd54
- SHA1 97412dba3cbeb0125c71b7b2ab194ea2fdff51b2
- SHA512 76ca5f677bc8ee1485f3d5b028b3a91f74344e9ff7af3c62a98e737a9888bd35389b3e6bf7b8b67747e0f64e1c973c0708864f12de1388b95f5c31b4e084e2e1
- SSDEEP 6144:cUudhn2yq9XzD0216Ta7CfqwbYs78LCA7uQUjRRMbq0gdyTwwFEbK1ldfI+niDNQ:czrnfqhDCqwbYs78LCA7qRMbq0ge3xg6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\session.tmp
- Size 32B
- SHA256 160211a63ccba5381d6f68ef7e49a1dbb3a7c53df4a61fb3d2cbd7b2b011f97f
- MD5 e8cb764dda43cde825b772148a9005f5
- SHA1 7634d3686bc531e8e382a59493024916cdac3c28
- SHA512 ebe6c5f4a6f70cc7bceba30ddbdb2adde53c0a83bc3342ec96cdf722440fba1f8b49bc4d3257c281e9a2cd2f6ea4b87a15f4c0d881be77572187af9307688926
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\7za.exe
- Size 772KB
- SHA256 ab15a9b27ee2d69a8bc8c8d1f5f40f28cd568f5cbb28d36ed938110203f8d142
- MD5 b93eb0a48c91a53bda6a1a074a4b431e
- SHA1 ac693a14c697b1a8ee80318e260e817b8ee2aa86
- SHA512 732cb0dcb2b1dac1a7462554c256cec27de243734f79b7f87026e9f5fbae6d5d8a5f14a702d2af0b65897b6abad70a9eff1905dc851ce267d221ddcdd9e640c5
- SSDEEP 24576:DFhjj7f4K+ao308d0ORMz27R0iIdclDJiD:JlwpP90OFWxD
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\DC.exe
- Size 802KB
- SHA256 c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
- MD5 ac34ba84a5054cd701efad5dd14645c9
- SHA1 dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
- SHA512 df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
- SSDEEP 12288:NaWzgMg7v3qnCiPErQohh0F4uCJ8lnyIQJ9QudhzYOekDXiGt8PSmQ:MaHMv6CrrjSnyIQ8+ekGA8PSmQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\DC.exe
- Size 802KB
- SHA256 c576f7f55c4c0304b290b15e70a638b037df15c69577cd6263329c73416e490e
- MD5 ac34ba84a5054cd701efad5dd14645c9
- SHA1 dc74a9fd5560b7c7a0fc9d183de9d676e92b9e8b
- SHA512 df491306a3c8ddb580b7cca1dce9e22a87fd43ca3632f3630cdcbe114bef243e847b2ce774d688f6e142516f2e0fc49d30fad7c7168e627523da21e2fe06836a
- SSDEEP 12288:NaWzgMg7v3qnCiPErQohh0F4uCJ8lnyIQJ9QudhzYOekDXiGt8PSmQ:MaHMv6CrrjSnyIQ8+ekGA8PSmQ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.db
- Size 12.7MB
- SHA256 044a1b4bc66711f88da720dbba401c3277391190ed2ed9b689213b394bfb88a8
- MD5 aaad8fa498ed4866de0010b417f979aa
- SHA1 694621414048655bd53835de8358869aa86a816b
- SHA512 7c40dd584394101d7e50f463d8fb72525b248ec3a565feeaa7a555c58fb18717600ce4e8efd0ed9aba57fbae2da800ba13bcc03233494808406d7d1dd370d495
- SSDEEP 98304:she3q5l+Yf85ahed8XCIXuY0l8KbYqajc:so6ltf85KedNIeY0lGc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
- Size 1.7MB
- SHA256 4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
- MD5 c44487ce1827ce26ac4699432d15b42a
- SHA1 8434080fad778057a50607364fee8b481f0feef8
- SHA512 a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
- SSDEEP 49152:sVzyP4BTkT3EApTLi2CCzMn3jzjAhFEy+eaXr:sVzyABTwEH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
- Size 1.7MB
- SHA256 4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
- MD5 c44487ce1827ce26ac4699432d15b42a
- SHA1 8434080fad778057a50607364fee8b481f0feef8
- SHA512 a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
- SSDEEP 49152:sVzyP4BTkT3EApTLi2CCzMn3jzjAhFEy+eaXr:sVzyABTwEH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.exe
- Size 1.7MB
- SHA256 4c83e46a29106afbaf5279029d102b489d958781764289b61ab5b618a4307405
- MD5 c44487ce1827ce26ac4699432d15b42a
- SHA1 8434080fad778057a50607364fee8b481f0feef8
- SHA512 a0ea698333c21e59b5bc79d79ff39d185a019cede394dbd8b2eb72c4230001685a90098a691c296aeab27db6751eef56c4261cf00f790de2e9e9efc0e7f7c808
- SSDEEP 49152:sVzyP4BTkT3EApTLi2CCzMn3jzjAhFEy+eaXr:sVzyABTwEH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.ini
- Size 548B
- SHA256 2fefb69e4b2310be5e09d329e8cf1bebd1f9e18884c8c2a38af8d7ea46bd5e01
- MD5 742c2400f2de964d0cce4a8dabadd708
- SHA1 c452d8d4c3a82af4bc57ca8a76e4407aaf90deca
- SHA512 63a7f1482dc15d558e1a26d1214fcecca14df6db78c88735a67d1a89185c05210edc38b38e3e014dac817df88968aaf47beb40e8298777fbb5308abfe16479e4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything.ini
- Size 20KB
- SHA256 659747ebdf5a8e245a0fb147ba637a685bde7e39ee734ffcba81acd7b681a42c
- MD5 488be4527e0fd7cd620255e040029db8
- SHA1 63344d889c733a359de168538bf6c880778697f6
- SHA512 73728bcc47ca1ce4f84795c8442e86f4b5ea8926bc2d58072f0f368527fe5cd8e10c50b6c2d9ce498340d1e3a67e33b9edac9518bd61bb2b639f9d157b8a859a
- SSDEEP 192:RjCxnELo+ny9QOL4jwnTef2JFTAiwTMisXZiPgCSjvtM8nbVwoQT6Au+Ztul4Axa:Rug6TeEFTA+isX/M8n8Z4z8lJCK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything2.ini
- Size 550B
- SHA256 89ad2164717bd5f5f93fbb4cebf0efeb473097408fddfc7fc7b924d790514dc5
- MD5 51014c0c06acdd80f9ae4469e7d30a9e
- SHA1 204e6a57c44242fad874377851b13099dfe60176
- SHA512 79b5e2727cce5cd9f6d2e886f93b22b72ec0ad4a6b9ad47205d7cf283606280665ead729ab3921d7e84409cfc09a94e749a68918130f0172856626f5f7af010c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything32.dll
- Size 84KB
- SHA256 8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
- MD5 3b03324537327811bbbaff4aafa4d75b
- SHA1 1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
- SHA512 ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
- SSDEEP 768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything32.dll
- Size 84KB
- SHA256 8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
- MD5 3b03324537327811bbbaff4aafa4d75b
- SHA1 1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
- SHA512 ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
- SSDEEP 768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything32.dll
- Size 84KB
- SHA256 8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
- MD5 3b03324537327811bbbaff4aafa4d75b
- SHA1 1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
- SHA512 ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
- SSDEEP 768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything32.dll
- Size 84KB
- SHA256 8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
- MD5 3b03324537327811bbbaff4aafa4d75b
- SHA1 1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
- SHA512 ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
- SSDEEP 768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything32.dll
- Size 84KB
- SHA256 8cae8a9740d466e17f16481e68de9cbd58265863c3924d66596048edfd87e880
- MD5 3b03324537327811bbbaff4aafa4d75b
- SHA1 1218bd8165a2e0ec56a88b5a8bb4b27e52b564e7
- SHA512 ba5312e1836bac0bb05b133b2b938be98b28646c8b8fc45804d7f252cd2e1a191667bfa8ba979bf2a07d49053114234b78cca83ef28aecf105d7169a3ec3dc62
- SSDEEP 768:r7q2ysU1Jr1SHx6p73TpzkqVVWwupGKcrrbRkzOnORqhJtfwxnZRqFlP+YiXoyIZ:r7q2EJx+OVkqTIZerpnA2tfet7XJIZ
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\Everything64.dll
- Size 1.5MB
- SHA256 1e077fc068b060e4356876e29ce01fd63598f1579a841336f4a30f73eda1f328
- MD5 c73353f0e0abf5ca18a10a268aefdb68
- SHA1 36887b5890bbd753f9556476ddb376208fe195fb
- SHA512 212546b076b59867ecf67b4cb060789b23ec9c167d0f0b311581ce272bb261cb4f8d8540fae3311fd3059906464214defb3cb3415fcf4769bfbe4e6bbaf4ad63
- SSDEEP 24576:6MFPWn0FIsS/i7IEWnXV59+lddNdnrbfp1RSdfFhxuhe4fJ5OGEI1rv1trFIAy/p:xPY0FFS6el5QPdbrbx1K7xI5RwhmtIAu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\sdel.exe
- Size 350KB
- SHA256 e8eaa39e2adfd49ab69d7bb8504ccb82a902c8b48fbc256472f36f41775e594c
- MD5 803df907d936e08fbbd06020c411be93
- SHA1 4aa4b498ae037a2b0479659374a5c3af5f6b8d97
- SHA512 5b9c44b4ed68b632360c66b35442722d2797807c88555c9fde9c176581d410e4f6ed433fabdcd9ee614db458158e6055a9f7f526ebfbc8e7f5f3d388f5de4532
- SSDEEP 6144:OBgL/kqXQangs2iKn5yvfj7wZxPzzLHrNJT7V:QgL5ga0iKn5GfPwZRT5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\sdel64.exe
- Size 448KB
- SHA256 5434dfdb731238edcb07a8c3a83594791536dda7a63c29f19be7bb1d59aedd60
- MD5 e2114b1627889b250c7fd0425ba1bd54
- SHA1 97412dba3cbeb0125c71b7b2ab194ea2fdff51b2
- SHA512 76ca5f677bc8ee1485f3d5b028b3a91f74344e9ff7af3c62a98e737a9888bd35389b3e6bf7b8b67747e0f64e1c973c0708864f12de1388b95f5c31b4e084e2e1
- SSDEEP 6144:cUudhn2yq9XzD0216Ta7CfqwbYs78LCA7uQUjRRMbq0gdyTwwFEbK1ldfI+niDNQ:czrnfqhDCqwbYs78LCA7qRMbq0ge3xg6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\session.tmp
- Size 32B
- SHA256 160211a63ccba5381d6f68ef7e49a1dbb3a7c53df4a61fb3d2cbd7b2b011f97f
- MD5 e8cb764dda43cde825b772148a9005f5
- SHA1 7634d3686bc531e8e382a59493024916cdac3c28
- SHA512 ebe6c5f4a6f70cc7bceba30ddbdb2adde53c0a83bc3342ec96cdf722440fba1f8b49bc4d3257c281e9a2cd2f6ea4b87a15f4c0d881be77572187af9307688926
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
- Size 2.0MB
- SHA256 a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e
- MD5 6d081da0c4ea3eff0e18d414047bb5fd
- SHA1 992fca17ad2fe4a6523c3858c87b0e5203628032
- SHA512 12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7
- SSDEEP 24576:w/iIzkQF+KpPnF1Fx+CszLyQ9lkxIQVki//47JhUhio7Z6OI93lGFtPtnNON+Ijo:whBPrElwNkto7VINlGFtPtnwjjOaW/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
- Size 2.0MB
- SHA256 a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e
- MD5 6d081da0c4ea3eff0e18d414047bb5fd
- SHA1 992fca17ad2fe4a6523c3858c87b0e5203628032
- SHA512 12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7
- SSDEEP 24576:w/iIzkQF+KpPnF1Fx+CszLyQ9lkxIQVki//47JhUhio7Z6OI93lGFtPtnNON+Ijo:whBPrElwNkto7VINlGFtPtnwjjOaW/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
- Size 2.0MB
- SHA256 a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e
- MD5 6d081da0c4ea3eff0e18d414047bb5fd
- SHA1 992fca17ad2fe4a6523c3858c87b0e5203628032
- SHA512 12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7
- SSDEEP 24576:w/iIzkQF+KpPnF1Fx+CszLyQ9lkxIQVki//47JhUhio7Z6OI93lGFtPtnNON+Ijo:whBPrElwNkto7VINlGFtPtnwjjOaW/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
- Size 2.0MB
- SHA256 a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e
- MD5 6d081da0c4ea3eff0e18d414047bb5fd
- SHA1 992fca17ad2fe4a6523c3858c87b0e5203628032
- SHA512 12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7
- SSDEEP 24576:w/iIzkQF+KpPnF1Fx+CszLyQ9lkxIQVki//47JhUhio7Z6OI93lGFtPtnNON+Ijo:whBPrElwNkto7VINlGFtPtnwjjOaW/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\{E0F1BE03-0AEF-2317-9406-4D53D1C6E3CA}\system86.exe
- Size 2.0MB
- SHA256 a9a4843ea9af569ab5ffd213ac4910898019083eb74ff8f36678092daca92f2e
- MD5 6d081da0c4ea3eff0e18d414047bb5fd
- SHA1 992fca17ad2fe4a6523c3858c87b0e5203628032
- SHA512 12ed7bc4cc716bcda716f5667593223fb5155b1ee14d967f2b217bc6373954a22c169fafe0d969980cf08bfea426996e04c47d70d0658af9db462a8341e9dcb7
- SSDEEP 24576:w/iIzkQF+KpPnF1Fx+CszLyQ9lkxIQVki//47JhUhio7Z6OI93lGFtPtnNON+Ijo:whBPrElwNkto7VINlGFtPtnwjjOaW/
- MD5 SHA1 SHA512 SSDEEP