ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65

Analysis

max time kernel
165s
max time network
31s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
Size

479KB
MD5

3eb9b8b5e2865bc2850a859bbd70c811
SHA1

50b4294b9ab808e571fa0db4393ee31541a2c251
SHA256

ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65
SHA512

78b3f03753ce1a1ef51bf2fc3314087a5016c6a56ce787e0d497c11858d348e3acf395497ecb95b65a480a524a48ef25e2abb56305681fd2acd42c55490ea603
SSDEEP

6144:9FIDFEULXJ9VBdcs9ZLbw64TgEg8fcwZRcF5vVATpJNbyUiAadSilHDTc:9FIJHxJ9ZLbw/TPcw0rVMLoAad/DTc

Score

9^/10

evasion persistence trojan upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 5 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000c0000000122ec-109.dat	acprotect
behavioral1/files/0x00090000000122ef-108.dat	acprotect
behavioral1/files/0x000c0000000122ec-114.dat	acprotect
behavioral1/files/0x00090000000122ef-115.dat	acprotect
behavioral1/files/0x00090000000122ef-116.dat	acprotect

Executes dropped EXE 5 IoCs

pid	Process
1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
1356	lsass.exe
1736	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
1968	lsass.exe
300	smss.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	lsass.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1364-54-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/1364-59-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x000b0000000122e9-60.dat	upx
behavioral1/files/0x000b0000000122e9-61.dat	upx
behavioral1/memory/1364-64-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x000b0000000122e9-63.dat	upx
behavioral1/files/0x000b0000000122e9-73.dat	upx
behavioral1/files/0x000a0000000122ee-75.dat	upx
behavioral1/files/0x000a0000000122ee-76.dat	upx
behavioral1/files/0x000a0000000122ee-78.dat	upx
behavioral1/memory/1356-87-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/1876-88-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x000a0000000122ee-95.dat	upx
behavioral1/files/0x000a0000000122ee-98.dat	upx
behavioral1/memory/1876-100-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x000a0000000122ee-101.dat	upx
behavioral1/files/0x000a0000000122ee-102.dat	upx
behavioral1/memory/1968-104-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/files/0x000c0000000122ec-109.dat	upx
behavioral1/files/0x00090000000122ef-108.dat	upx
behavioral1/files/0x000c0000000122ec-114.dat	upx
behavioral1/files/0x00090000000122ef-115.dat	upx
behavioral1/files/0x00090000000122ef-116.dat	upx
behavioral1/memory/1356-117-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral1/memory/300-118-0x0000000010000000-0x0000000010018000-memory.dmp	upx
behavioral1/memory/1356-121-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Loads dropped DLL 13 IoCs

pid	Process
1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
1356	lsass.exe
1356	lsass.exe
1356	lsass.exe
548	regsvr32.exe
300	smss.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe

Checks for any installed AV software in registry 1 TTPs 3 IoCs

Security Software Discovery

T1063

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService	lsass.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsass.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	lsass.exe
File opened (read-only)	\??\E:	lsass.exe

Drops autorun.inf file 1 TTPs 7 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\E:\autorun.inf	lsass.exe
File opened for modification	C:\AUTORUN.INF	lsass.exe
File created	C:\AUTORUN.INF	lsass.exe
File opened for modification	D:\AUTORUN.INF	lsass.exe
File opened for modification	\??\E:\AUTORUN.INF	lsass.exe
File opened for modification	C:\autorun.inf	lsass.exe
File opened for modification	D:\autorun.inf	lsass.exe

Drops file in System32 directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\com\netcfg.000	lsass.exe
File opened for modification	C:\Windows\SysWOW64\7188946.log	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\bak	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\smss.exe	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
File created	C:\Windows\SysWOW64\com\lsass.exe	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
File opened for modification	C:\Windows\SysWOW64\com\netcfg.dll	lsass.exe
File opened for modification	\??\c:\windows\SysWOW64\com\lsass.exe	lsass.exe
File created	C:\Windows\SysWOW64\com\lsass.exe	lsass.exe
File created	C:\Windows\SysWOW64\7188946.log	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\smss.exe	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
File created	C:\Windows\SysWOW64\00302.log	lsass.exe
File created	C:\Windows\SysWOW64\dnsq.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\lsass.exe	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
File created	C:\Windows\SysWOW64\com\netcfg.dll	lsass.exe
File created	C:\Windows\SysWOW64\00302.log	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
File created	C:\Windows\SysWOW64\com\smss.exe	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
File created	C:\Windows\SysWOW64\00302.log	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
File opened for modification	C:\Windows\SysWOW64\dnsq.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\smss.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\lsass.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\com\netcfg.000	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\FLAGS\ = "2"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\CLSID\ = "{D9901239-34A2-448D-A000-3705544ECE9D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\ = "IfObj Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ = "_DIfObj"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\InprocServer32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ = "IfObj Control"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\com"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ = "_DIfObjEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\ = "ifObj ActiveX Control module"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\ = "IfObj Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ProgID\ = "IFOBJ.IfObjCtrl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\Version = "1.0"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
1356	lsass.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
464	Process not Found
464	Process not Found
464	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
Token: SeDebugPrivilege	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
Token: SeDebugPrivilege	1356	lsass.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
1356	lsass.exe
1356	lsass.exe
1356	lsass.exe
1356	lsass.exe
1968	lsass.exe
1968	lsass.exe
1968	lsass.exe
1968	lsass.exe
1356	lsass.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 1508	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	28
PID 1364 wrote to memory of 1508	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	28
PID 1364 wrote to memory of 1508	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	28
PID 1364 wrote to memory of 1508	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	28
PID 1364 wrote to memory of 1420	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	30
PID 1364 wrote to memory of 1420	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	30
PID 1364 wrote to memory of 1420	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	30
PID 1364 wrote to memory of 1420	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	30
PID 1364 wrote to memory of 652	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	31
PID 1364 wrote to memory of 652	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	31
PID 1364 wrote to memory of 652	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	31
PID 1364 wrote to memory of 652	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	31
PID 1364 wrote to memory of 1876	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	34
PID 1364 wrote to memory of 1876	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	34
PID 1364 wrote to memory of 1876	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	34
PID 1364 wrote to memory of 1876	1364	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe	34
PID 1876 wrote to memory of 240	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	35
PID 1876 wrote to memory of 240	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	35
PID 1876 wrote to memory of 240	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	35
PID 1876 wrote to memory of 240	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	35
PID 1876 wrote to memory of 1884	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	37
PID 1876 wrote to memory of 1884	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	37
PID 1876 wrote to memory of 1884	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	37
PID 1876 wrote to memory of 1884	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	37
PID 1876 wrote to memory of 600	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	39
PID 1876 wrote to memory of 600	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	39
PID 1876 wrote to memory of 600	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	39
PID 1876 wrote to memory of 600	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	39
PID 1876 wrote to memory of 1204	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	41
PID 1876 wrote to memory of 1204	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	41
PID 1876 wrote to memory of 1204	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	41
PID 1876 wrote to memory of 1204	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	41
PID 1876 wrote to memory of 828	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	42
PID 1876 wrote to memory of 828	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	42
PID 1876 wrote to memory of 828	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	42
PID 1876 wrote to memory of 828	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	42
PID 1876 wrote to memory of 1680	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	43
PID 1876 wrote to memory of 1680	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	43
PID 1876 wrote to memory of 1680	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	43
PID 1876 wrote to memory of 1680	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	43
PID 1876 wrote to memory of 832	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	47
PID 1876 wrote to memory of 832	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	47
PID 1876 wrote to memory of 832	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	47
PID 1876 wrote to memory of 832	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	47
PID 1876 wrote to memory of 1356	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	49
PID 1876 wrote to memory of 1356	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	49
PID 1876 wrote to memory of 1356	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	49
PID 1876 wrote to memory of 1356	1876	ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log	49
PID 1356 wrote to memory of 1952	1356	lsass.exe	50
PID 1356 wrote to memory of 1952	1356	lsass.exe	50
PID 1356 wrote to memory of 1952	1356	lsass.exe	50
PID 1356 wrote to memory of 1952	1356	lsass.exe	50
PID 1356 wrote to memory of 1576	1356	lsass.exe	52
PID 1356 wrote to memory of 1576	1356	lsass.exe	52
PID 1356 wrote to memory of 1576	1356	lsass.exe	52
PID 1356 wrote to memory of 1576	1356	lsass.exe	52
PID 1356 wrote to memory of 1640	1356	lsass.exe	53
PID 1356 wrote to memory of 1640	1356	lsass.exe	53
PID 1356 wrote to memory of 1640	1356	lsass.exe	53
PID 1356 wrote to memory of 1640	1356	lsass.exe	53
PID 1356 wrote to memory of 1060	1356	lsass.exe	54
PID 1356 wrote to memory of 1060	1356	lsass.exe	54
PID 1356 wrote to memory of 1060	1356	lsass.exe	54
PID 1356 wrote to memory of 1060	1356	lsass.exe	54

C:\Users\Admin\AppData\Local\Temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
"C:\Users\Admin\AppData\Local\Temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe"
1⤵
- Sets file execution options in registry
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c echo ok
  2⤵
  PID:1508
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F
  2⤵
  PID:1420
- C:\Windows\SysWOW64\cacls.exe
  "C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F
  2⤵
  PID:652
- \??\c:\users\admin\appdata\local\temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
  "c:\users\admin\appdata\local\temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log"
  2⤵
  - Executes dropped EXE
  - Sets file execution options in registry
  - Loads dropped DLL
  - Checks for any installed AV software in registry
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c echo ok
    3⤵
    PID:240
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F
    3⤵
    PID:1884
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F
    3⤵
    PID:600
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Admin:F
    3⤵
    PID:1204
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Everyone:F
    3⤵
    PID:828
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c rd /s /q "C:\Windows\system32\com\smss.exe"
    3⤵
    PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c del /F /Q "C:\Windows\system32\com\lsass.exe"
    3⤵
    PID:832
- - C:\Windows\SysWOW64\com\lsass.exe
    "C:\Windows\system32\com\lsass.exe"
    3⤵
    - Executes dropped EXE
    - Sets file execution options in registry
    - Loads dropped DLL
    - Checks for any installed AV software in registry
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c echo ok
      4⤵
      PID:1952
  - - C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F
      4⤵
      PID:1576
  - - C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Everyone:F
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Windows\system32\com\lsass.exe /e /t /g Admin:F
      4⤵
      PID:1060
  - - C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Windows\system32\com\lsass.exe /e /t /g Everyone:F
      4⤵
      PID:1252
  - - C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Admin:F
      4⤵
      PID:860
  - - C:\Windows\SysWOW64\cacls.exe
      "C:\Windows\System32\cacls.exe" C:\Windows\system32\com\smss.exe /e /t /g Everyone:F
      4⤵
      PID:376
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c rd /s /q "C:\Windows\system32\com\smss.exe"
      4⤵
      PID:1468
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c rd /s /q "C:\Windows\system32\com\lsass.exe"
      4⤵
      PID:1008
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" C:\Windows\system32\com\netcfg.dll /s
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:548
  - - C:\Windows\SysWOW64\com\smss.exe
      C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\~.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:300
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c rd /s /q "C:\Windows\system32\dnsq.dll"
      4⤵
      PID:1392
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c rd /s /q "C:\Windows\system32\com\bak"
      4⤵
      PID:828
- - C:\Users\Admin\appdata\local\temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe
    "C:\Users\Admin\appdata\local\temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe"
    3⤵
    - Executes dropped EXE
    PID:1736
- - C:\Windows\SysWOW64\com\lsass.exe
    ^c:\users\admin\appdata\local\temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of SetWindowsHookEx
    PID:1968

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Security Software Discovery

T1063

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe

Filesize
296KB

MD5
fbd2b1873564b87d27ef056c5135f115

SHA1
1a5a8584ba4d84949856cfb8c242241640df5b4c

SHA256
43756e183e9413a9bf58238ebe5043488606f09239c3fc3d042d3decffb65885

SHA512
2cda5d5b9abb32a172fedd8035818cf6865d93ead7c740210eafaf734d4c35cfb5fd4803ab5d4b7d7ffab490a0d4310b12b0fe6e7bbb9cd9f87a6fc2155c95fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log

Filesize
479KB

MD5
3eb9b8b5e2865bc2850a859bbd70c811

SHA1
50b4294b9ab808e571fa0db4393ee31541a2c251

SHA256
ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65

SHA512
78b3f03753ce1a1ef51bf2fc3314087a5016c6a56ce787e0d497c11858d348e3acf395497ecb95b65a480a524a48ef25e2abb56305681fd2acd42c55490ea603

Download Submit
C:\Windows\SysWOW64\com\lsass.exe

Filesize
91KB

MD5
98192f86c4d9f9ef20e6b5fcb0be75bb

SHA1
3ec326b238c03a39abb54c2dd394911355b848f3

SHA256
1fa1159e582da5b2edeaf15e647c7b5cb2fcb72be75a18825c811495f5f711c8

SHA512
8a859dd894298e7450141909573068902d1a7c9aa338b64ebe489d227d5e0ad2da011c53553eb863490e77020ada7fe970de431991599c964b7b6dacac0d9c5b

Download Submit
C:\Windows\SysWOW64\com\lsass.exe

Filesize
91KB

MD5
98192f86c4d9f9ef20e6b5fcb0be75bb

SHA1
3ec326b238c03a39abb54c2dd394911355b848f3

SHA256
1fa1159e582da5b2edeaf15e647c7b5cb2fcb72be75a18825c811495f5f711c8

SHA512
8a859dd894298e7450141909573068902d1a7c9aa338b64ebe489d227d5e0ad2da011c53553eb863490e77020ada7fe970de431991599c964b7b6dacac0d9c5b

Download Submit
C:\Windows\SysWOW64\com\lsass.exe

Filesize
91KB

MD5
98192f86c4d9f9ef20e6b5fcb0be75bb

SHA1
3ec326b238c03a39abb54c2dd394911355b848f3

SHA256
1fa1159e582da5b2edeaf15e647c7b5cb2fcb72be75a18825c811495f5f711c8

SHA512
8a859dd894298e7450141909573068902d1a7c9aa338b64ebe489d227d5e0ad2da011c53553eb863490e77020ada7fe970de431991599c964b7b6dacac0d9c5b

Download Submit
C:\Windows\SysWOW64\com\netcfg.dll

Filesize
16KB

MD5
d1f6b9273cbb2e23aeed11346d0072c5

SHA1
0d012a7c7b37082dcbd5e1688f72eeade705f825

SHA256
dfb2d7cdc6ea056948d09fe139255af2dcc58f3581f4a50f4e5ee0f5a03c39fc

SHA512
4c3ab878131ad38a54d04cf0d268430ab98a67df474a18ee7858c62561d90ec14c34ed63dd973fdf24115ebf17ef65a6a9fc9ac612c247903e881e584dc3b77e

Download Submit
C:\Windows\SysWOW64\com\smss.exe

Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
C:\Windows\SysWOW64\com\smss.exe

Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
C:\Windows\SysWOW64\com\smss.exe

Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
C:\Windows\SysWOW64\dnsq.dll

Filesize
31KB

MD5
43afc709415b0dfb297dab1209d993b4

SHA1
41c01847c7533aa848ae3f1b82535385857693ed

SHA256
70a6d9489cbb1d3384780f0529c9b32e537e24bdf13c315d7b8e6b3d9d14fc8f

SHA512
a84cade3177e0d1b0672082faebca2a728f69f97750b080bd43a1567307e3b253b48e102adb7fb20ca48d882cb7094a8e1a7a0f816def1acca6072f3a21aaa91

Download Submit
\??\c:\users\admin\appdata\local\temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log

Filesize
479KB

MD5
3eb9b8b5e2865bc2850a859bbd70c811

SHA1
50b4294b9ab808e571fa0db4393ee31541a2c251

SHA256
ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65

SHA512
78b3f03753ce1a1ef51bf2fc3314087a5016c6a56ce787e0d497c11858d348e3acf395497ecb95b65a480a524a48ef25e2abb56305681fd2acd42c55490ea603

Download Submit
\Users\Admin\AppData\Local\Temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe

Filesize
296KB

MD5
fbd2b1873564b87d27ef056c5135f115

SHA1
1a5a8584ba4d84949856cfb8c242241640df5b4c

SHA256
43756e183e9413a9bf58238ebe5043488606f09239c3fc3d042d3decffb65885

SHA512
2cda5d5b9abb32a172fedd8035818cf6865d93ead7c740210eafaf734d4c35cfb5fd4803ab5d4b7d7ffab490a0d4310b12b0fe6e7bbb9cd9f87a6fc2155c95fb

Download Submit
\Users\Admin\AppData\Local\Temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe

Filesize
296KB

MD5
fbd2b1873564b87d27ef056c5135f115

SHA1
1a5a8584ba4d84949856cfb8c242241640df5b4c

SHA256
43756e183e9413a9bf58238ebe5043488606f09239c3fc3d042d3decffb65885

SHA512
2cda5d5b9abb32a172fedd8035818cf6865d93ead7c740210eafaf734d4c35cfb5fd4803ab5d4b7d7ffab490a0d4310b12b0fe6e7bbb9cd9f87a6fc2155c95fb

Download Submit
\Users\Admin\AppData\Local\Temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log

Filesize
479KB

MD5
3eb9b8b5e2865bc2850a859bbd70c811

SHA1
50b4294b9ab808e571fa0db4393ee31541a2c251

SHA256
ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65

SHA512
78b3f03753ce1a1ef51bf2fc3314087a5016c6a56ce787e0d497c11858d348e3acf395497ecb95b65a480a524a48ef25e2abb56305681fd2acd42c55490ea603

Download Submit
\Users\Admin\AppData\Local\Temp\ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65.exe.log

Filesize
479KB

MD5
3eb9b8b5e2865bc2850a859bbd70c811

SHA1
50b4294b9ab808e571fa0db4393ee31541a2c251

SHA256
ac59b4fab6607e679dd3cd0a98284778b7c1f73aa81da2aa9210bcf892ad1a65

SHA512
78b3f03753ce1a1ef51bf2fc3314087a5016c6a56ce787e0d497c11858d348e3acf395497ecb95b65a480a524a48ef25e2abb56305681fd2acd42c55490ea603

Download Submit
\Windows\SysWOW64\com\lsass.exe

Filesize
91KB

MD5
98192f86c4d9f9ef20e6b5fcb0be75bb

SHA1
3ec326b238c03a39abb54c2dd394911355b848f3

SHA256
1fa1159e582da5b2edeaf15e647c7b5cb2fcb72be75a18825c811495f5f711c8

SHA512
8a859dd894298e7450141909573068902d1a7c9aa338b64ebe489d227d5e0ad2da011c53553eb863490e77020ada7fe970de431991599c964b7b6dacac0d9c5b

Download Submit
\Windows\SysWOW64\com\lsass.exe

Filesize
91KB

MD5
98192f86c4d9f9ef20e6b5fcb0be75bb

SHA1
3ec326b238c03a39abb54c2dd394911355b848f3

SHA256
1fa1159e582da5b2edeaf15e647c7b5cb2fcb72be75a18825c811495f5f711c8

SHA512
8a859dd894298e7450141909573068902d1a7c9aa338b64ebe489d227d5e0ad2da011c53553eb863490e77020ada7fe970de431991599c964b7b6dacac0d9c5b

Download Submit
\Windows\SysWOW64\com\lsass.exe

Filesize
91KB

MD5
98192f86c4d9f9ef20e6b5fcb0be75bb

SHA1
3ec326b238c03a39abb54c2dd394911355b848f3

SHA256
1fa1159e582da5b2edeaf15e647c7b5cb2fcb72be75a18825c811495f5f711c8

SHA512
8a859dd894298e7450141909573068902d1a7c9aa338b64ebe489d227d5e0ad2da011c53553eb863490e77020ada7fe970de431991599c964b7b6dacac0d9c5b

Download Submit
\Windows\SysWOW64\com\lsass.exe

Filesize
91KB

MD5
98192f86c4d9f9ef20e6b5fcb0be75bb

SHA1
3ec326b238c03a39abb54c2dd394911355b848f3

SHA256
1fa1159e582da5b2edeaf15e647c7b5cb2fcb72be75a18825c811495f5f711c8

SHA512
8a859dd894298e7450141909573068902d1a7c9aa338b64ebe489d227d5e0ad2da011c53553eb863490e77020ada7fe970de431991599c964b7b6dacac0d9c5b

Download Submit
\Windows\SysWOW64\com\netcfg.dll

Filesize
16KB

MD5
d1f6b9273cbb2e23aeed11346d0072c5

SHA1
0d012a7c7b37082dcbd5e1688f72eeade705f825

SHA256
dfb2d7cdc6ea056948d09fe139255af2dcc58f3581f4a50f4e5ee0f5a03c39fc

SHA512
4c3ab878131ad38a54d04cf0d268430ab98a67df474a18ee7858c62561d90ec14c34ed63dd973fdf24115ebf17ef65a6a9fc9ac612c247903e881e584dc3b77e

Download Submit
\Windows\SysWOW64\com\smss.exe

Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
\Windows\SysWOW64\com\smss.exe

Filesize
40KB

MD5
ae1cd1d740c265b7f18f827f9e37afab

SHA1
6b976bc56e4021e7237b3cd4dbe412b6949fb0a0

SHA256
a961e4f09ebcf11e1e384361d20d4ac031b3c159b9e6d50e3b4612102bef2a11

SHA512
c8f973cbece698f0701171be501c5c24fb77345c05c136ba992b97f74b81c0487e4039c5bb9b43176cc3815e8f2181377811a8a4d8fb08f741fa304767b50571

Download Submit
\Windows\SysWOW64\dnsq.dll

Filesize
31KB

MD5
43afc709415b0dfb297dab1209d993b4

SHA1
41c01847c7533aa848ae3f1b82535385857693ed

SHA256
70a6d9489cbb1d3384780f0529c9b32e537e24bdf13c315d7b8e6b3d9d14fc8f

SHA512
a84cade3177e0d1b0672082faebca2a728f69f97750b080bd43a1567307e3b253b48e102adb7fb20ca48d882cb7094a8e1a7a0f816def1acca6072f3a21aaa91

Download Submit
\Windows\SysWOW64\dnsq.dll

Filesize
31KB

MD5
43afc709415b0dfb297dab1209d993b4

SHA1
41c01847c7533aa848ae3f1b82535385857693ed

SHA256
70a6d9489cbb1d3384780f0529c9b32e537e24bdf13c315d7b8e6b3d9d14fc8f

SHA512
a84cade3177e0d1b0672082faebca2a728f69f97750b080bd43a1567307e3b253b48e102adb7fb20ca48d882cb7094a8e1a7a0f816def1acca6072f3a21aaa91

Download Submit
memory/240-66-0x0000000000000000-mapping.dmp

Download
memory/300-118-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/300-112-0x0000000000000000-mapping.dmp

Download
memory/376-90-0x0000000000000000-mapping.dmp

Download
memory/548-106-0x0000000000000000-mapping.dmp

Download
memory/600-68-0x0000000000000000-mapping.dmp

Download
memory/652-58-0x0000000000000000-mapping.dmp

Download
memory/828-120-0x0000000000000000-mapping.dmp

Download
memory/828-70-0x0000000000000000-mapping.dmp

Download
memory/832-74-0x0000000000000000-mapping.dmp

Download
memory/860-89-0x0000000000000000-mapping.dmp

Download
memory/1008-105-0x0000000000000000-mapping.dmp

Download
memory/1060-83-0x0000000000000000-mapping.dmp

Download
memory/1204-69-0x0000000000000000-mapping.dmp

Download
memory/1252-86-0x0000000000000000-mapping.dmp

Download
memory/1356-121-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1356-77-0x0000000000000000-mapping.dmp

Download
memory/1356-87-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1356-117-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1364-54-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1364-64-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1364-55-0x0000000075611000-0x0000000075613000-memory.dmp

Filesize
8KB

Download
memory/1364-59-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1392-119-0x0000000000000000-mapping.dmp

Download
memory/1420-57-0x0000000000000000-mapping.dmp

Download
memory/1468-91-0x0000000000000000-mapping.dmp

Download
memory/1508-56-0x0000000000000000-mapping.dmp

Download
memory/1576-81-0x0000000000000000-mapping.dmp

Download
memory/1640-82-0x0000000000000000-mapping.dmp

Download
memory/1680-71-0x0000000000000000-mapping.dmp

Download
memory/1736-94-0x0000000000000000-mapping.dmp

Download
memory/1876-84-0x0000000002B60000-0x0000000002B8B000-memory.dmp

Filesize
172KB

Download
memory/1876-62-0x0000000000000000-mapping.dmp

Download
memory/1876-100-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1876-85-0x0000000002B60000-0x0000000002B8B000-memory.dmp

Filesize
172KB

Download
memory/1876-88-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1884-67-0x0000000000000000-mapping.dmp

Download
memory/1952-80-0x0000000000000000-mapping.dmp

Download
memory/1968-104-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/1968-99-0x0000000000000000-mapping.dmp

Download