Analysis
-
max time kernel
187s -
max time network
177s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 01:11
Behavioral task
behavioral1
Sample
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe
Resource
win10v2004-20220901-en
General
-
Target
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe
-
Size
272KB
-
MD5
15baf936ad283c5b3075acca81b2d8c0
-
SHA1
ac2a303b5206d85049e05546e7917a8b62c66d75
-
SHA256
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf
-
SHA512
96f7aed1fa623d60ae1d5191b6d3810aa6ba8dc789ea79ee3d72a6a2ecfddaf633e6b6703125fffe5d63dcd95328e9496c240385e2470c2041187396699227ae
-
SSDEEP
6144:KD3vjxbG3rR1qxwzcP2vrcff/KBAOROq952w:KD9bG3rexwz5vrcffiBTB52w
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 5 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule \Windows\SysWOW64\dnsq.dll acprotect C:\Windows\SysWOW64\com\netcfg.dll acprotect \Windows\SysWOW64\com\netcfg.dll acprotect \Windows\SysWOW64\dnsq.dll acprotect C:\Windows\SysWOW64\dnsq.dll acprotect -
Executes dropped EXE 5 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exelsass.exesmss.exepid process 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 1412 lsass.exe 1704 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 1684 lsass.exe 556 smss.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options lsass.exe -
Processes:
resource yara_rule behavioral1/memory/1116-55-0x0000000000400000-0x000000000042C000-memory.dmp upx \Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log upx \Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log upx C:\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log upx behavioral1/memory/1116-63-0x0000000000400000-0x000000000042C000-memory.dmp upx \??\c:\users\admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log upx \Windows\SysWOW64\com\lsass.exe upx \Windows\SysWOW64\com\lsass.exe upx C:\Windows\SysWOW64\com\lsass.exe upx behavioral1/memory/540-79-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1412-83-0x0000000000400000-0x000000000042C000-memory.dmp upx C:\Windows\SysWOW64\com\lsass.exe upx \Windows\SysWOW64\com\lsass.exe upx \Windows\SysWOW64\com\lsass.exe upx C:\Windows\SysWOW64\com\lsass.exe upx behavioral1/memory/540-103-0x0000000000400000-0x000000000042C000-memory.dmp upx behavioral1/memory/1684-104-0x0000000000400000-0x000000000042C000-memory.dmp upx \Windows\SysWOW64\dnsq.dll upx C:\Windows\SysWOW64\com\netcfg.dll upx \Windows\SysWOW64\com\netcfg.dll upx behavioral1/memory/1412-115-0x0000000010000000-0x0000000010019000-memory.dmp upx \Windows\SysWOW64\dnsq.dll upx C:\Windows\SysWOW64\dnsq.dll upx behavioral1/memory/556-118-0x0000000010000000-0x0000000010019000-memory.dmp upx behavioral1/memory/1412-120-0x0000000000400000-0x000000000042C000-memory.dmp upx -
Loads dropped DLL 13 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exeregsvr32.exesmss.exepid process 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 1412 lsass.exe 1412 lsass.exe 1412 lsass.exe 640 regsvr32.exe 556 smss.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe -
Checks for any installed AV software in registry 1 TTPs 3 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService lsass.exe -
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exelsass.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lsass.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lsass.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
lsass.exedescription ioc process File opened (read-only) \??\E: lsass.exe File opened (read-only) \??\e: lsass.exe -
Drops autorun.inf file 1 TTPs 7 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
lsass.exedescription ioc process File created C:\AUTORUN.INF lsass.exe File opened for modification D:\AUTORUN.INF lsass.exe File opened for modification \??\E:\AUTORUN.INF lsass.exe File opened for modification C:\autorun.inf lsass.exe File opened for modification D:\autorun.inf lsass.exe File opened for modification \??\E:\autorun.inf lsass.exe File opened for modification C:\AUTORUN.INF lsass.exe -
Drops file in System32 directory 23 IoCs
Processes:
lsass.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.logdescription ioc process File opened for modification C:\Windows\SysWOW64\7123036.log lsass.exe File created C:\Windows\SysWOW64\7123036.log lsass.exe File created C:\Windows\SysWOW64\com\lsass.exe lsass.exe File opened for modification C:\Windows\SysWOW64\com\bak lsass.exe File opened for modification C:\Windows\SysWOW64\com\smss.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe File created C:\Windows\SysWOW64\com\smss.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe File opened for modification C:\Windows\SysWOW64\com\smss.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log File created C:\Windows\SysWOW64\00302.log lsass.exe File created C:\Windows\SysWOW64\com\netcfg.dll lsass.exe File created C:\Windows\SysWOW64\dnsq.dll lsass.exe File opened for modification C:\Windows\SysWOW64\7123894.log lsass.exe File created C:\Windows\SysWOW64\00302.log 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe File created C:\Windows\SysWOW64\00302.log 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log File opened for modification C:\Windows\SysWOW64\com\netcfg.000 lsass.exe File created C:\Windows\SysWOW64\com\netcfg.000 lsass.exe File created C:\Windows\SysWOW64\com\lsass.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log File opened for modification C:\Windows\SysWOW64\com\smss.exe lsass.exe File opened for modification C:\Windows\SysWOW64\com\netcfg.dll lsass.exe File opened for modification \??\c:\windows\SysWOW64\com\lsass.exe lsass.exe File opened for modification C:\Windows\SysWOW64\com\lsass.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log File opened for modification C:\Windows\SysWOW64\com\lsass.exe lsass.exe File opened for modification C:\Windows\SysWOW64\dnsq.dll lsass.exe File created C:\Windows\SysWOW64\7123894.log lsass.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 64 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ProgID\ = "IFOBJ.IfObjCtrl.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ = "IfObj Control" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ = "_DIfObj" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll, 1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0\win32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\ = "IfObj Property Page" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\InprocServer32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\ = "IfObj Control" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\com" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ = "_DIfObjEvents" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\CLSID\ = "{D9901239-34A2-448D-A000-3705544ECE9D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\ = "ifObj ActiveX Control module" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ = "_DIfObj" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\1\ = "131473" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Control regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ = "_DIfObjEvents" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\ = "0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32 regsvr32.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exepid process 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 1412 lsass.exe -
Suspicious behavior: LoadsDriver 3 IoCs
Processes:
pid process 464 464 464 -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exedescription pid process Token: SeDebugPrivilege 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe Token: SeDebugPrivilege 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log Token: SeDebugPrivilege 1412 lsass.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exelsass.exepid process 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log 1412 lsass.exe 1412 lsass.exe 1412 lsass.exe 1412 lsass.exe 1684 lsass.exe 1684 lsass.exe 1684 lsass.exe 1684 lsass.exe 1412 lsass.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.loglsass.exedescription pid process target process PID 1116 wrote to memory of 1000 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cmd.exe PID 1116 wrote to memory of 1000 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cmd.exe PID 1116 wrote to memory of 1000 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cmd.exe PID 1116 wrote to memory of 1000 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cmd.exe PID 1116 wrote to memory of 576 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1116 wrote to memory of 576 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1116 wrote to memory of 576 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1116 wrote to memory of 576 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1116 wrote to memory of 320 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1116 wrote to memory of 320 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1116 wrote to memory of 320 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1116 wrote to memory of 320 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe cacls.exe PID 1116 wrote to memory of 540 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log PID 1116 wrote to memory of 540 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log PID 1116 wrote to memory of 540 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log PID 1116 wrote to memory of 540 1116 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log PID 540 wrote to memory of 1616 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 540 wrote to memory of 1616 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 540 wrote to memory of 1616 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 540 wrote to memory of 1616 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 540 wrote to memory of 936 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 936 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 936 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 936 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 1876 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 1876 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 1876 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 1876 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 1976 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 1976 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 1976 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 1976 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 1624 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 1624 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 1624 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 1624 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cacls.exe PID 540 wrote to memory of 1096 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 540 wrote to memory of 1096 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 540 wrote to memory of 1096 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 540 wrote to memory of 1096 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 540 wrote to memory of 836 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 540 wrote to memory of 836 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 540 wrote to memory of 836 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 540 wrote to memory of 836 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log cmd.exe PID 540 wrote to memory of 1412 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log lsass.exe PID 540 wrote to memory of 1412 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log lsass.exe PID 540 wrote to memory of 1412 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log lsass.exe PID 540 wrote to memory of 1412 540 8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log lsass.exe PID 1412 wrote to memory of 1488 1412 lsass.exe cmd.exe PID 1412 wrote to memory of 1488 1412 lsass.exe cmd.exe PID 1412 wrote to memory of 1488 1412 lsass.exe cmd.exe PID 1412 wrote to memory of 1488 1412 lsass.exe cmd.exe PID 1412 wrote to memory of 2028 1412 lsass.exe cacls.exe PID 1412 wrote to memory of 2028 1412 lsass.exe cacls.exe PID 1412 wrote to memory of 2028 1412 lsass.exe cacls.exe PID 1412 wrote to memory of 2028 1412 lsass.exe cacls.exe PID 1412 wrote to memory of 304 1412 lsass.exe cacls.exe PID 1412 wrote to memory of 304 1412 lsass.exe cacls.exe PID 1412 wrote to memory of 304 1412 lsass.exe cacls.exe PID 1412 wrote to memory of 304 1412 lsass.exe cacls.exe PID 1412 wrote to memory of 784 1412 lsass.exe cacls.exe PID 1412 wrote to memory of 784 1412 lsass.exe cacls.exe PID 1412 wrote to memory of 784 1412 lsass.exe cacls.exe PID 1412 wrote to memory of 784 1412 lsass.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe"C:\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe"1⤵
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c echo ok2⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F2⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F2⤵
-
\??\c:\users\admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log"c:\users\admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log"2⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c echo ok3⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F3⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F3⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Admin:F3⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Everyone:F3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /s /q "C:\Windows\system32\com\smss.exe"3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c del /F /Q "C:\Windows\system32\com\lsass.exe"3⤵
-
C:\Windows\SysWOW64\com\lsass.exe"C:\Windows\system32\com\lsass.exe"3⤵
- Executes dropped EXE
- Sets file execution options in registry
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c echo ok4⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F4⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F4⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\lsass.exe /e /t /g Admin:F4⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\lsass.exe /e /t /g Everyone:F4⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Admin:F4⤵
-
C:\Windows\SysWOW64\cacls.exe"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Everyone:F4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /s /q "C:\Windows\system32\com\smss.exe"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /s /q "C:\Windows\system32\com\lsass.exe"4⤵
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" C:\Windows\system32\com\netcfg.dll /s4⤵
- Loads dropped DLL
- Modifies registry class
-
C:\Windows\SysWOW64\com\smss.exeC:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\~.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /s /q "C:\Windows\system32\dnsq.dll"4⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /c rd /s /q "C:\Windows\system32\com\bak"4⤵
-
C:\Windows\SysWOW64\ping.exeping.exe -f -n 1 www.baidu.com4⤵
- Runs ping.exe
-
C:\Users\Admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe"C:\Users\Admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\com\lsass.exe^c:\users\admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.log3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exeFilesize
88KB
MD5cf2ffd93807eb73965d5a4f438260658
SHA1114c7ff564ea417493604c1c03b5d414308c54f7
SHA25628957191fc57c5aba81e89989bf48f86a57e8df3f966eea0d96b5bf7b7b163e8
SHA5125c691c8003050dd9385dfbdb9b5556003ee05915fc0e87e08d55e95362f9c7a1429a0ad3ec70fb333c4647d5d02b8cb1797156e3939843073a0554b745f8efa4
-
C:\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.logFilesize
272KB
MD515baf936ad283c5b3075acca81b2d8c0
SHA1ac2a303b5206d85049e05546e7917a8b62c66d75
SHA2568548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf
SHA51296f7aed1fa623d60ae1d5191b6d3810aa6ba8dc789ea79ee3d72a6a2ecfddaf633e6b6703125fffe5d63dcd95328e9496c240385e2470c2041187396699227ae
-
C:\Windows\SysWOW64\com\lsass.exeFilesize
92KB
MD5dc67758a5be75ce168a118b4982b3dbe
SHA1cfe27b21c63e73d46cc8e4ef4f91812ce4a79d36
SHA2561aac5652d94e369a50c9c502380350eaf2770d3779f932e5dba807942e29a0ff
SHA512ba82562f35e9105b63c8fb805bb9706f0864633461f05c475a9d1893ddf08bfe153b0c3a712553ba39c9011f49f2a0ced54f4e2e901739afebad1b4665ddd917
-
C:\Windows\SysWOW64\com\lsass.exeFilesize
92KB
MD5dc67758a5be75ce168a118b4982b3dbe
SHA1cfe27b21c63e73d46cc8e4ef4f91812ce4a79d36
SHA2561aac5652d94e369a50c9c502380350eaf2770d3779f932e5dba807942e29a0ff
SHA512ba82562f35e9105b63c8fb805bb9706f0864633461f05c475a9d1893ddf08bfe153b0c3a712553ba39c9011f49f2a0ced54f4e2e901739afebad1b4665ddd917
-
C:\Windows\SysWOW64\com\lsass.exeFilesize
92KB
MD5dc67758a5be75ce168a118b4982b3dbe
SHA1cfe27b21c63e73d46cc8e4ef4f91812ce4a79d36
SHA2561aac5652d94e369a50c9c502380350eaf2770d3779f932e5dba807942e29a0ff
SHA512ba82562f35e9105b63c8fb805bb9706f0864633461f05c475a9d1893ddf08bfe153b0c3a712553ba39c9011f49f2a0ced54f4e2e901739afebad1b4665ddd917
-
C:\Windows\SysWOW64\com\netcfg.dllFilesize
16KB
MD5d1f6b9273cbb2e23aeed11346d0072c5
SHA10d012a7c7b37082dcbd5e1688f72eeade705f825
SHA256dfb2d7cdc6ea056948d09fe139255af2dcc58f3581f4a50f4e5ee0f5a03c39fc
SHA5124c3ab878131ad38a54d04cf0d268430ab98a67df474a18ee7858c62561d90ec14c34ed63dd973fdf24115ebf17ef65a6a9fc9ac612c247903e881e584dc3b77e
-
C:\Windows\SysWOW64\com\smss.exeFilesize
40KB
MD5ae1cd1d740c265b7f18f827f9e37afab
SHA16b976bc56e4021e7237b3cd4dbe412b6949fb0a0
SHA256a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11
SHA512c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571
-
C:\Windows\SysWOW64\com\smss.exeFilesize
40KB
MD5ae1cd1d740c265b7f18f827f9e37afab
SHA16b976bc56e4021e7237b3cd4dbe412b6949fb0a0
SHA256a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11
SHA512c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571
-
C:\Windows\SysWOW64\com\smss.exeFilesize
40KB
MD5ae1cd1d740c265b7f18f827f9e37afab
SHA16b976bc56e4021e7237b3cd4dbe412b6949fb0a0
SHA256a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11
SHA512c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571
-
C:\Windows\SysWOW64\dnsq.dllFilesize
31KB
MD5f515bd3278588b6d58a316d059e2778f
SHA1ae8d987f33930d305b9d60685549dcabefa8e932
SHA2565c8d02e0398882cb177fe91068fb31cf28fa401c7c060692ca2fda86479f9310
SHA512688227aa4355cc7c156327992ae855b2aae294f12bb786bc71fb30690af3f46ad32ae360f004b899a575d833636b0c546005c85313c325e1893e5e67c9d1121c
-
\??\c:\users\admin\appdata\local\temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.logFilesize
272KB
MD515baf936ad283c5b3075acca81b2d8c0
SHA1ac2a303b5206d85049e05546e7917a8b62c66d75
SHA2568548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf
SHA51296f7aed1fa623d60ae1d5191b6d3810aa6ba8dc789ea79ee3d72a6a2ecfddaf633e6b6703125fffe5d63dcd95328e9496c240385e2470c2041187396699227ae
-
\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exeFilesize
88KB
MD5cf2ffd93807eb73965d5a4f438260658
SHA1114c7ff564ea417493604c1c03b5d414308c54f7
SHA25628957191fc57c5aba81e89989bf48f86a57e8df3f966eea0d96b5bf7b7b163e8
SHA5125c691c8003050dd9385dfbdb9b5556003ee05915fc0e87e08d55e95362f9c7a1429a0ad3ec70fb333c4647d5d02b8cb1797156e3939843073a0554b745f8efa4
-
\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exeFilesize
88KB
MD5cf2ffd93807eb73965d5a4f438260658
SHA1114c7ff564ea417493604c1c03b5d414308c54f7
SHA25628957191fc57c5aba81e89989bf48f86a57e8df3f966eea0d96b5bf7b7b163e8
SHA5125c691c8003050dd9385dfbdb9b5556003ee05915fc0e87e08d55e95362f9c7a1429a0ad3ec70fb333c4647d5d02b8cb1797156e3939843073a0554b745f8efa4
-
\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.logFilesize
272KB
MD515baf936ad283c5b3075acca81b2d8c0
SHA1ac2a303b5206d85049e05546e7917a8b62c66d75
SHA2568548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf
SHA51296f7aed1fa623d60ae1d5191b6d3810aa6ba8dc789ea79ee3d72a6a2ecfddaf633e6b6703125fffe5d63dcd95328e9496c240385e2470c2041187396699227ae
-
\Users\Admin\AppData\Local\Temp\8548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf.exe.logFilesize
272KB
MD515baf936ad283c5b3075acca81b2d8c0
SHA1ac2a303b5206d85049e05546e7917a8b62c66d75
SHA2568548fbd28728ccded1cf33d0f31835111471716ce9dcb77af926a56e59924aaf
SHA51296f7aed1fa623d60ae1d5191b6d3810aa6ba8dc789ea79ee3d72a6a2ecfddaf633e6b6703125fffe5d63dcd95328e9496c240385e2470c2041187396699227ae
-
\Windows\SysWOW64\com\lsass.exeFilesize
92KB
MD5dc67758a5be75ce168a118b4982b3dbe
SHA1cfe27b21c63e73d46cc8e4ef4f91812ce4a79d36
SHA2561aac5652d94e369a50c9c502380350eaf2770d3779f932e5dba807942e29a0ff
SHA512ba82562f35e9105b63c8fb805bb9706f0864633461f05c475a9d1893ddf08bfe153b0c3a712553ba39c9011f49f2a0ced54f4e2e901739afebad1b4665ddd917
-
\Windows\SysWOW64\com\lsass.exeFilesize
92KB
MD5dc67758a5be75ce168a118b4982b3dbe
SHA1cfe27b21c63e73d46cc8e4ef4f91812ce4a79d36
SHA2561aac5652d94e369a50c9c502380350eaf2770d3779f932e5dba807942e29a0ff
SHA512ba82562f35e9105b63c8fb805bb9706f0864633461f05c475a9d1893ddf08bfe153b0c3a712553ba39c9011f49f2a0ced54f4e2e901739afebad1b4665ddd917
-
\Windows\SysWOW64\com\lsass.exeFilesize
92KB
MD5dc67758a5be75ce168a118b4982b3dbe
SHA1cfe27b21c63e73d46cc8e4ef4f91812ce4a79d36
SHA2561aac5652d94e369a50c9c502380350eaf2770d3779f932e5dba807942e29a0ff
SHA512ba82562f35e9105b63c8fb805bb9706f0864633461f05c475a9d1893ddf08bfe153b0c3a712553ba39c9011f49f2a0ced54f4e2e901739afebad1b4665ddd917
-
\Windows\SysWOW64\com\lsass.exeFilesize
92KB
MD5dc67758a5be75ce168a118b4982b3dbe
SHA1cfe27b21c63e73d46cc8e4ef4f91812ce4a79d36
SHA2561aac5652d94e369a50c9c502380350eaf2770d3779f932e5dba807942e29a0ff
SHA512ba82562f35e9105b63c8fb805bb9706f0864633461f05c475a9d1893ddf08bfe153b0c3a712553ba39c9011f49f2a0ced54f4e2e901739afebad1b4665ddd917
-
\Windows\SysWOW64\com\netcfg.dllFilesize
16KB
MD5d1f6b9273cbb2e23aeed11346d0072c5
SHA10d012a7c7b37082dcbd5e1688f72eeade705f825
SHA256dfb2d7cdc6ea056948d09fe139255af2dcc58f3581f4a50f4e5ee0f5a03c39fc
SHA5124c3ab878131ad38a54d04cf0d268430ab98a67df474a18ee7858c62561d90ec14c34ed63dd973fdf24115ebf17ef65a6a9fc9ac612c247903e881e584dc3b77e
-
\Windows\SysWOW64\com\smss.exeFilesize
40KB
MD5ae1cd1d740c265b7f18f827f9e37afab
SHA16b976bc56e4021e7237b3cd4dbe412b6949fb0a0
SHA256a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11
SHA512c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571
-
\Windows\SysWOW64\com\smss.exeFilesize
40KB
MD5ae1cd1d740c265b7f18f827f9e37afab
SHA16b976bc56e4021e7237b3cd4dbe412b6949fb0a0
SHA256a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11
SHA512c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571
-
\Windows\SysWOW64\dnsq.dllFilesize
31KB
MD5f515bd3278588b6d58a316d059e2778f
SHA1ae8d987f33930d305b9d60685549dcabefa8e932
SHA2565c8d02e0398882cb177fe91068fb31cf28fa401c7c060692ca2fda86479f9310
SHA512688227aa4355cc7c156327992ae855b2aae294f12bb786bc71fb30690af3f46ad32ae360f004b899a575d833636b0c546005c85313c325e1893e5e67c9d1121c
-
\Windows\SysWOW64\dnsq.dllFilesize
31KB
MD5f515bd3278588b6d58a316d059e2778f
SHA1ae8d987f33930d305b9d60685549dcabefa8e932
SHA2565c8d02e0398882cb177fe91068fb31cf28fa401c7c060692ca2fda86479f9310
SHA512688227aa4355cc7c156327992ae855b2aae294f12bb786bc71fb30690af3f46ad32ae360f004b899a575d833636b0c546005c85313c325e1893e5e67c9d1121c
-
memory/304-85-0x0000000000000000-mapping.dmp
-
memory/320-58-0x0000000000000000-mapping.dmp
-
memory/340-119-0x0000000000000000-mapping.dmp
-
memory/524-91-0x0000000000000000-mapping.dmp
-
memory/540-81-0x0000000002B50000-0x0000000002B7C000-memory.dmpFilesize
176KB
-
memory/540-103-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/540-61-0x0000000000000000-mapping.dmp
-
memory/540-80-0x0000000002B50000-0x0000000002B7C000-memory.dmpFilesize
176KB
-
memory/540-79-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/556-110-0x0000000000000000-mapping.dmp
-
memory/556-118-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/576-57-0x0000000000000000-mapping.dmp
-
memory/640-106-0x0000000000000000-mapping.dmp
-
memory/784-86-0x0000000000000000-mapping.dmp
-
memory/836-73-0x0000000000000000-mapping.dmp
-
memory/900-122-0x0000000000000000-mapping.dmp
-
memory/936-66-0x0000000000000000-mapping.dmp
-
memory/1000-56-0x0000000000000000-mapping.dmp
-
memory/1096-71-0x0000000000000000-mapping.dmp
-
memory/1116-54-0x0000000076381000-0x0000000076383000-memory.dmpFilesize
8KB
-
memory/1116-55-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1116-63-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1244-87-0x0000000000000000-mapping.dmp
-
memory/1412-76-0x0000000000000000-mapping.dmp
-
memory/1412-83-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1412-120-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1412-115-0x0000000010000000-0x0000000010019000-memory.dmpFilesize
100KB
-
memory/1452-105-0x0000000000000000-mapping.dmp
-
memory/1488-82-0x0000000000000000-mapping.dmp
-
memory/1608-88-0x0000000000000000-mapping.dmp
-
memory/1616-65-0x0000000000000000-mapping.dmp
-
memory/1624-69-0x0000000000000000-mapping.dmp
-
memory/1684-99-0x0000000000000000-mapping.dmp
-
memory/1684-104-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1704-94-0x0000000000000000-mapping.dmp
-
memory/1712-90-0x0000000000000000-mapping.dmp
-
memory/1876-67-0x0000000000000000-mapping.dmp
-
memory/1932-121-0x0000000000000000-mapping.dmp
-
memory/1976-68-0x0000000000000000-mapping.dmp
-
memory/2028-84-0x0000000000000000-mapping.dmp