2272d371baab4042dad848e5dcf8206a3c2c7507fb7bec05e736f7f99ba97d40

Analysis

max time kernel
151s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/11/2022, 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2272d371baab4042dad848e5dcf8206a3c2c7507fb7bec05e736f7f99ba97d40.exe
Size

20KB
MD5

23698beef2dfbd7c0a1e5d70a10cf9b0
SHA1

2c23dc56fd2236a64c156eaffbda87902c366b76
SHA256

2272d371baab4042dad848e5dcf8206a3c2c7507fb7bec05e736f7f99ba97d40
SHA512

f91e0f883d558eb2fef6125885d5c31cfbee5a4fa0d9031865530e990ee2c6ad295884726bf123803506152a2ffc3c5cc1fd19555964cded50eb273949b4fa3d
SSDEEP

192:1l5E3krTuntKy0peHDfCpHfBv+I4QwXt9V+jqu0G5KDJB4Jo:1M3PnQoHDCpHf4I4Qwdc0G5KDJai

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	2272d371baab4042dad848e5dcf8206a3c2c7507fb7bec05e736f7f99ba97d40.exe
File opened for modification	C:\Windows\SysWOW64\drivers\winlogon.exe	winlogon.exe
File created	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe
File opened for modification	C:\Windows\SysWOW64\drivers\Msvbvm60.dll	winlogon.exe

Executes dropped EXE 4 IoCs

pid	Process
1664	winlogon.exe
516	AE 0124 BE.exe
1640	winlogon.exe
1260	winlogon.exe

Loads dropped DLL 6 IoCs

pid	Process
288	2272d371baab4042dad848e5dcf8206a3c2c7507fb7bec05e736f7f99ba97d40.exe
288	2272d371baab4042dad848e5dcf8206a3c2c7507fb7bec05e736f7f99ba97d40.exe
1664	winlogon.exe
1664	winlogon.exe
516	AE 0124 BE.exe
516	AE 0124 BE.exe

Drops desktop.ini file(s) 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Calligraphy\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Characters\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Heritage\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Delta\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Cityscape\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Landscape\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Raga\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Fonts\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Sonata\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Afternoon\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Quirky\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Savanna\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Link\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Link\desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Festival\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Media\Garden\Desktop.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Offline Web Pages\desktop.ini	AE 0124 BE.exe

Drops autorun.inf file 1 TTPs 27 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\M:\Autorun.inf	winlogon.exe
File opened for modification	\??\T:\Autorun.inf	winlogon.exe
File opened for modification	\??\W:\Autorun.inf	winlogon.exe
File opened for modification	\??\I:\Autorun.inf	winlogon.exe
File opened for modification	\??\K:\Autorun.inf	winlogon.exe
File opened for modification	\??\U:\Autorun.inf	winlogon.exe
File opened for modification	\??\L:\Autorun.inf	winlogon.exe
File opened for modification	\??\N:\Autorun.inf	winlogon.exe
File opened for modification	\??\R:\Autorun.inf	winlogon.exe
File opened for modification	\??\V:\Autorun.inf	winlogon.exe
File opened for modification	\??\A:\Autorun.inf	winlogon.exe
File opened for modification	\??\F:\Autorun.inf	winlogon.exe
File opened for modification	\??\X:\Autorun.inf	winlogon.exe
File opened for modification	\??\Y:\Autorun.inf	winlogon.exe
File opened for modification	C:\Autorun.inf	winlogon.exe
File opened for modification	\??\E:\Autorun.inf	winlogon.exe
File opened for modification	\??\P:\Autorun.inf	winlogon.exe
File opened for modification	C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf	AE 0124 BE.exe
File opened for modification	\??\Z:\Autorun.inf	winlogon.exe
File opened for modification	\??\B:\Autorun.inf	winlogon.exe
File opened for modification	\??\G:\Autorun.inf	winlogon.exe
File opened for modification	\??\Q:\Autorun.inf	winlogon.exe
File opened for modification	\??\S:\Autorun.inf	winlogon.exe
File opened for modification	D:\Autorun.inf	winlogon.exe
File opened for modification	\??\H:\Autorun.inf	winlogon.exe
File opened for modification	\??\J:\Autorun.inf	winlogon.exe
File opened for modification	\??\O:\Autorun.inf	winlogon.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\regedit.exe	AE 0124 BE.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_MSIL\MICROSOFT.VISUALBASIC.COMPATIBILITY.resources\8.0.0.0_it_b03f5f7f11d50a3a	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\Windows\it-IT\seccntr.h1s	AE 0124 BE.exe
File opened for modification	C:\Windows\schemas\EAPMethods\eaptlsuserpropertiesv1.xsd	AE 0124 BE.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\Windows\es-ES\domain.h1s	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\it\System.EnterpriseServices.Resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-InternetExplorer-Optional-Package~31bf3856ad364e35~amd64~~11.2.9600.16428.mum	AE 0124 BE.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Links-Package~31bf3856ad364e35~amd64~~6.1.7601.17514.mum	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\mdmcomp.inf	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\wiaca00a.inf	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft	AE 0124 BE.exe
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache	AE 0124 BE.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Client-LanguagePack-Package~31bf3856ad364e35~amd64~it-IT~6.1.7601.17514.cat	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\system.io.log.resources\3.0.0.0_it_b03f5f7f11d50a3a	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DataVisualization	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\Search\CL_Utility.ps1	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\Windows\ja-JP\itprobasic.h1s	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\.NET CLR Networking 4.0.0.0\0804\_Networkingperfcounters.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.Services.Client	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\AppConfig\App_LocalResources\AppSetting.ascx.resx	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Configuration.Install.resources	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Web.DynamicData.Design\3.5.0.0__31bf3856ad364e35	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.In#\1ea8ad2c4072a33cc9f2981dea3b8ddf	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\ASP.NET_4.0.30319\0019\aspnet_perf.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Cursors\help_il.cur	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\HomeGroup\es-ES	AE 0124 BE.exe
File opened for modification	C:\Windows\PolicyDefinitions\de-DE\TaskScheduler.adml	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0010\PerfCounters.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\GAC\ja\Microsoft.VisualBasic.Compatibility.resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.Transactions.Bridge\3.0.0.0__b03f5f7f11d50a3a\Microsoft.Transactions.Bridge.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Ente96d83b35#\6682e8964200a1336f1dbe49392f7797	AE 0124 BE.exe
File opened for modification	C:\Windows\Boot\EFI\pl-PL\bootmgr.efi.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\diagnostics\system\AERO\ja-JP	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\ASP.NET\0013\aspnet_perf2.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\naphlpr\03d99e593bc94e308005a972667d7ca9\naphlpr.ni.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\XsdBuildTask\v4.0_4.0.0.0__31bf3856ad364e35	AE 0124 BE.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Help-CoreClientUAUE-Package~31bf3856ad364e35~amd64~en-US~6.1.7601.17514.cat	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Contract.v9.0\9.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management.A#\4436815b432c313255af322f4ec3560d\System.Management.Automation.ni.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\ehome\ehSidebarRes.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Activities.DurableInstancing.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Prefetch\ReadyBoot\ReadyBoot.etl	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v3.5\MOF\fr\ServiceModel35.mfl.uninstall	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\9469491f37d9c35b596968b206615309\mscorlib.ni.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Net	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Baa2ca56b#\b2f6d024120fb8ac1b0225c025d7c1fa	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Net\5d99e71477e553552914ea6eadf6bdc0\System.Net.ni.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\SMSvcHost 3.0.0.0	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Luna\v4.0_4.0.0.0__31bf3856ad364e35	AE 0124 BE.exe
File opened for modification	C:\Windows\Prefetch\CMD.EXE-4A81B364.pf	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Printing.resources	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\System.Web.Entity.resources\3.5.0.0_de_b77a5c561934e089	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\mui\0C0A\sqlsoldb.chm	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\Windows\en-US\Windows_AssetId.H1K	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\mdmtdkj7.PNF	AE 0124 BE.exe
File opened for modification	C:\Windows\inf\WmiApRpl\0009\WmiApRpl.ini	AE 0124 BE.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\normnfc.nlp	AE 0124 BE.exe
File opened for modification	C:\Windows\servicing\Packages\Microsoft-Windows-Common-Modem-Drivers-Package~31bf3856ad364e35~amd64~fr-FR~6.1.7601.17514.cat	AE 0124 BE.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\UIAutomationClient.resources\3.0.0.0_it_31bf3856ad364e35\UIAutomationClient.resources.dll	AE 0124 BE.exe
File opened for modification	C:\Windows\Boot\EFI\it-IT\bootmgr.efi.mui	AE 0124 BE.exe
File opened for modification	C:\Windows\Help\Windows\fr-FR\Windows_LinkTerm.H1K	AE 0124 BE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1356	DllHost.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
288	2272d371baab4042dad848e5dcf8206a3c2c7507fb7bec05e736f7f99ba97d40.exe
1664	winlogon.exe
516	AE 0124 BE.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 288 wrote to memory of 1664	288	2272d371baab4042dad848e5dcf8206a3c2c7507fb7bec05e736f7f99ba97d40.exe	28
PID 288 wrote to memory of 1664	288	2272d371baab4042dad848e5dcf8206a3c2c7507fb7bec05e736f7f99ba97d40.exe	28
PID 288 wrote to memory of 1664	288	2272d371baab4042dad848e5dcf8206a3c2c7507fb7bec05e736f7f99ba97d40.exe	28
PID 288 wrote to memory of 1664	288	2272d371baab4042dad848e5dcf8206a3c2c7507fb7bec05e736f7f99ba97d40.exe	28
PID 1664 wrote to memory of 516	1664	winlogon.exe	29
PID 1664 wrote to memory of 516	1664	winlogon.exe	29
PID 1664 wrote to memory of 516	1664	winlogon.exe	29
PID 1664 wrote to memory of 516	1664	winlogon.exe	29
PID 1664 wrote to memory of 1640	1664	winlogon.exe	30
PID 1664 wrote to memory of 1640	1664	winlogon.exe	30
PID 1664 wrote to memory of 1640	1664	winlogon.exe	30
PID 1664 wrote to memory of 1640	1664	winlogon.exe	30
PID 516 wrote to memory of 1260	516	AE 0124 BE.exe	31
PID 516 wrote to memory of 1260	516	AE 0124 BE.exe	31
PID 516 wrote to memory of 1260	516	AE 0124 BE.exe	31
PID 516 wrote to memory of 1260	516	AE 0124 BE.exe	31

C:\Users\Admin\AppData\Local\Temp\2272d371baab4042dad848e5dcf8206a3c2c7507fb7bec05e736f7f99ba97d40.exe
"C:\Users\Admin\AppData\Local\Temp\2272d371baab4042dad848e5dcf8206a3c2c7507fb7bec05e736f7f99ba97d40.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288
- C:\Windows\SysWOW64\drivers\winlogon.exe
  "C:\Windows\System32\drivers\winlogon.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops autorun.inf file
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\AE 0124 BE.exe
    "C:\Windows\AE 0124 BE.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops desktop.ini file(s)
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:516
  - - C:\Windows\SysWOW64\drivers\winlogon.exe
      "C:\Windows\System32\drivers\winlogon.exe"
      4⤵
      Executes dropped EXE
      PID:1260
- - C:\Windows\SysWOW64\drivers\winlogon.exe
    "C:\Windows\System32\drivers\winlogon.exe"
    3⤵
    - Executes dropped EXE
    PID:1640

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\AE 0124 BE.exe

Filesize
40KB

MD5
08d7d0372faf3cf8cb82d92241cba8a1

SHA1
7ba6b910b7557863e6fc148f3f558d273ecc02ae

SHA256
1e43fba4bc78e11467b85026e0b39c722d6de02600d5b96e597669400b75f8e8

SHA512
de8cb8123b08757761eeedf0454f1962e85b66d5e72101285d6990f1398a3b5a229f8963481b4a8929d2068bbadab08a85f532a2a87514d0475ce74394db83e6

Download Submit
C:\Windows\AE 0124 BE.exe

Filesize
40KB

MD5
08d7d0372faf3cf8cb82d92241cba8a1

SHA1
7ba6b910b7557863e6fc148f3f558d273ecc02ae

SHA256
1e43fba4bc78e11467b85026e0b39c722d6de02600d5b96e597669400b75f8e8

SHA512
de8cb8123b08757761eeedf0454f1962e85b66d5e72101285d6990f1398a3b5a229f8963481b4a8929d2068bbadab08a85f532a2a87514d0475ce74394db83e6

Download Submit
C:\Windows\AE 0124 BE.jpg

Filesize
40KB

MD5
c5fd9a4458a2bec8addde51f91b41d83

SHA1
2c3cc0301319db6442724b9b3eafd462683fe7eb

SHA256
21a0cd2d4b53d84e43dd22b514dab170ddfb9002b8ec1727f578f339ccca534b

SHA512
805202b00855b48b73812be07b2157f5fea3f65b524554ef7c1b0cf9651d1b52c2f6624227b70a71294c417395fd3b7015e41cc84661b8ee6f4e7f7c9da728e4

Download Submit
C:\Windows\AE 0124 BE.jpg

Filesize
40KB

MD5
c5fd9a4458a2bec8addde51f91b41d83

SHA1
2c3cc0301319db6442724b9b3eafd462683fe7eb

SHA256
21a0cd2d4b53d84e43dd22b514dab170ddfb9002b8ec1727f578f339ccca534b

SHA512
805202b00855b48b73812be07b2157f5fea3f65b524554ef7c1b0cf9651d1b52c2f6624227b70a71294c417395fd3b7015e41cc84661b8ee6f4e7f7c9da728e4

Download Submit
C:\Windows\Msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
08d7d0372faf3cf8cb82d92241cba8a1

SHA1
7ba6b910b7557863e6fc148f3f558d273ecc02ae

SHA256
1e43fba4bc78e11467b85026e0b39c722d6de02600d5b96e597669400b75f8e8

SHA512
de8cb8123b08757761eeedf0454f1962e85b66d5e72101285d6990f1398a3b5a229f8963481b4a8929d2068bbadab08a85f532a2a87514d0475ce74394db83e6

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
08d7d0372faf3cf8cb82d92241cba8a1

SHA1
7ba6b910b7557863e6fc148f3f558d273ecc02ae

SHA256
1e43fba4bc78e11467b85026e0b39c722d6de02600d5b96e597669400b75f8e8

SHA512
de8cb8123b08757761eeedf0454f1962e85b66d5e72101285d6990f1398a3b5a229f8963481b4a8929d2068bbadab08a85f532a2a87514d0475ce74394db83e6

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
08d7d0372faf3cf8cb82d92241cba8a1

SHA1
7ba6b910b7557863e6fc148f3f558d273ecc02ae

SHA256
1e43fba4bc78e11467b85026e0b39c722d6de02600d5b96e597669400b75f8e8

SHA512
de8cb8123b08757761eeedf0454f1962e85b66d5e72101285d6990f1398a3b5a229f8963481b4a8929d2068bbadab08a85f532a2a87514d0475ce74394db83e6

Download Submit
C:\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
08d7d0372faf3cf8cb82d92241cba8a1

SHA1
7ba6b910b7557863e6fc148f3f558d273ecc02ae

SHA256
1e43fba4bc78e11467b85026e0b39c722d6de02600d5b96e597669400b75f8e8

SHA512
de8cb8123b08757761eeedf0454f1962e85b66d5e72101285d6990f1398a3b5a229f8963481b4a8929d2068bbadab08a85f532a2a87514d0475ce74394db83e6

Download Submit
\??\c:\B1uv3nth3x1.diz

Filesize
25B

MD5
589b6886a49054d03b739309a1de9fcc

SHA1
0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

SHA256
564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

SHA512
4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

Download Submit
\??\c:\B1uv3nth3x1.diz

Filesize
25B

MD5
589b6886a49054d03b739309a1de9fcc

SHA1
0ec1dff7a03f13dea28eea5e754d5b0e5e1dc308

SHA256
564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8

SHA512
4b6f567398863aba39eec00e9f071364b79d5c29867b93fb968725e10e33a9bfff60f8ab6acceae44e715a35ec7139d12da06c33fa074b6be02ff5357c53c0eb

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
08d7d0372faf3cf8cb82d92241cba8a1

SHA1
7ba6b910b7557863e6fc148f3f558d273ecc02ae

SHA256
1e43fba4bc78e11467b85026e0b39c722d6de02600d5b96e597669400b75f8e8

SHA512
de8cb8123b08757761eeedf0454f1962e85b66d5e72101285d6990f1398a3b5a229f8963481b4a8929d2068bbadab08a85f532a2a87514d0475ce74394db83e6

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
08d7d0372faf3cf8cb82d92241cba8a1

SHA1
7ba6b910b7557863e6fc148f3f558d273ecc02ae

SHA256
1e43fba4bc78e11467b85026e0b39c722d6de02600d5b96e597669400b75f8e8

SHA512
de8cb8123b08757761eeedf0454f1962e85b66d5e72101285d6990f1398a3b5a229f8963481b4a8929d2068bbadab08a85f532a2a87514d0475ce74394db83e6

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
08d7d0372faf3cf8cb82d92241cba8a1

SHA1
7ba6b910b7557863e6fc148f3f558d273ecc02ae

SHA256
1e43fba4bc78e11467b85026e0b39c722d6de02600d5b96e597669400b75f8e8

SHA512
de8cb8123b08757761eeedf0454f1962e85b66d5e72101285d6990f1398a3b5a229f8963481b4a8929d2068bbadab08a85f532a2a87514d0475ce74394db83e6

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
08d7d0372faf3cf8cb82d92241cba8a1

SHA1
7ba6b910b7557863e6fc148f3f558d273ecc02ae

SHA256
1e43fba4bc78e11467b85026e0b39c722d6de02600d5b96e597669400b75f8e8

SHA512
de8cb8123b08757761eeedf0454f1962e85b66d5e72101285d6990f1398a3b5a229f8963481b4a8929d2068bbadab08a85f532a2a87514d0475ce74394db83e6

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
08d7d0372faf3cf8cb82d92241cba8a1

SHA1
7ba6b910b7557863e6fc148f3f558d273ecc02ae

SHA256
1e43fba4bc78e11467b85026e0b39c722d6de02600d5b96e597669400b75f8e8

SHA512
de8cb8123b08757761eeedf0454f1962e85b66d5e72101285d6990f1398a3b5a229f8963481b4a8929d2068bbadab08a85f532a2a87514d0475ce74394db83e6

Download Submit
\Windows\SysWOW64\drivers\winlogon.exe

Filesize
40KB

MD5
08d7d0372faf3cf8cb82d92241cba8a1

SHA1
7ba6b910b7557863e6fc148f3f558d273ecc02ae

SHA256
1e43fba4bc78e11467b85026e0b39c722d6de02600d5b96e597669400b75f8e8

SHA512
de8cb8123b08757761eeedf0454f1962e85b66d5e72101285d6990f1398a3b5a229f8963481b4a8929d2068bbadab08a85f532a2a87514d0475ce74394db83e6

Download Submit
memory/288-56-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads