cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4

Analysis

max time kernel
150s
max time network
63s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 13:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4.exe
Size

26KB
MD5

8f43b59aeb545a3d22043ec018ce8829
SHA1

172f517fa0df5ae3c1fb944ba45de4bfd90e7374
SHA256

cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4
SHA512

145375a0801a1dbd46719dd36f82ecf5d767df3bddb8539b5da3539e6c3d95f45907b1f3f8af734ae5b1c8670147c88db853e9af4e92eebea4091bb2244c66db
SSDEEP

384:2v5RX7/eyZoFIle1q5brt2jZwNz99dIOyctItwqXIcLc5IxmyOgaezzasZ8zhpbQ:2xZkIRrIZYqOyctstBIcLK

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.exe

Executes dropped EXE 1 IoCs

pid	Process
1188	Trojan.exe

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Modify Existing Service

T1031

pid	Process
268	netsh.exe
1368	netsh.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	wscript.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	Trojan.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe	Trojan.exe

Loads dropped DLL 4 IoCs

pid	Process
1552	cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4.exe
1552	cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4.exe
280	wscript.exe
280	wscript.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	wscript.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	wscript.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .."	Trojan.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Trojan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry class 61 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32\ = "mscoree.dll"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\ProgId	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\Implemented Categories	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ihludifjtqi.A	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\ProgId\ = "ihludifjtqi.fsttrecfdyb"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ihludifjtqi.fsttrecfdyb\CLSID	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32\RuntimeVersion = "v2.0.50727"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ihludifjtqi.fsttrecfdyb	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ihludifjtqi.fsttrecfdyb\CLSID\ = "{851E108D-154F-3BFA-801D-B6F5B45B971C}"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\Implemented Categories	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\Implemented Categories	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\Implemented Categories	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\ProgId	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ihludifjtqi.A\CLSID	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ihludifjtqi.A\CLSID\ = "{80AFEB14-E36B-3258-872C-280E32C8CA58}"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\ = "ihludifjtqi.fsttrecfdyb"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32\Class = "ihludifjtqi.fsttrecfdyb"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\ProgId	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32\Assembly = "ihludifjtqi, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ihludifjtqi.fsttrecfdyb\ = "ihludifjtqi.fsttrecfdyb"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32\0.0.0.0\Class = "ihludifjtqi.fsttrecfdyb"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ihludifjtqi.A\ = "ihludifjtqi.A"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32\ThreadingModel = "Both"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32\0.0.0.0\CodeBase = "file:///C:/Users/Admin/AppData/Local/Temp/Trojan.exe"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32\Class = "ihludifjtqi.A"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\ProgId\ = "ihludifjtqi.A"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32\ = "mscoree.dll"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32\Assembly = "ihludifjtqi, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32\0.0.0.0	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32\0.0.0.0	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32\ThreadingModel = "Both"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32\RuntimeVersion = "v2.0.50727"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32\0.0.0.0\Class = "ihludifjtqi.A"	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32\0.0.0.0\RuntimeVersion = "v2.0.50727"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\ProgId	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ihludifjtqi.A\CLSID	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\ = "ihludifjtqi.A"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32\0.0.0.0	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}\0 = ".NET Category"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ihludifjtqi.A	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ihludifjtqi.fsttrecfdyb\CLSID	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{851E108D-154F-3BFA-801D-B6F5B45B971C}\InprocServer32\0.0.0.0\Assembly = "ihludifjtqi, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Trojan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32\0.0.0.0	Trojan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80AFEB14-E36B-3258-872C-280E32C8CA58}\InprocServer32\0.0.0.0\Assembly = "ihludifjtqi, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null"	Trojan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ihludifjtqi.fsttrecfdyb	Trojan.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 1188	1552	cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4.exe	28
PID 1552 wrote to memory of 1188	1552	cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4.exe	28
PID 1552 wrote to memory of 1188	1552	cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4.exe	28
PID 1552 wrote to memory of 1188	1552	cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4.exe	28
PID 1188 wrote to memory of 268	1188	Trojan.exe	29
PID 1188 wrote to memory of 268	1188	Trojan.exe	29
PID 1188 wrote to memory of 268	1188	Trojan.exe	29
PID 1188 wrote to memory of 268	1188	Trojan.exe	29
PID 1188 wrote to memory of 1368	1188	Trojan.exe	31
PID 1188 wrote to memory of 1368	1188	Trojan.exe	31
PID 1188 wrote to memory of 1368	1188	Trojan.exe	31
PID 1188 wrote to memory of 1368	1188	Trojan.exe	31
PID 1188 wrote to memory of 280	1188	Trojan.exe	33
PID 1188 wrote to memory of 280	1188	Trojan.exe	33
PID 1188 wrote to memory of 280	1188	Trojan.exe	33
PID 1188 wrote to memory of 280	1188	Trojan.exe	33

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Trojan.exe

C:\Users\Admin\AppData\Local\Temp\cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4.exe
"C:\Users\Admin\AppData\Local\Temp\cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1552
- C:\Users\Admin\AppData\Local\Temp\Trojan.exe
  "C:\Users\Admin\AppData\Local\Temp\Trojan.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Drops startup file
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1188
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:268
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Windows\SysWOW64\wscript.exe" "wscript.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:1368
- - C:\Windows\SysWOW64\wscript.exe
    "C:\Windows\SysWOW64\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\Trojan.vbe"
    3⤵
    - Drops startup file
    - Loads dropped DLL
    - Adds Run key to start application
    PID:280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Trojan.exe

Filesize
26KB

MD5
8f43b59aeb545a3d22043ec018ce8829

SHA1
172f517fa0df5ae3c1fb944ba45de4bfd90e7374

SHA256
cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4

SHA512
145375a0801a1dbd46719dd36f82ecf5d767df3bddb8539b5da3539e6c3d95f45907b1f3f8af734ae5b1c8670147c88db853e9af4e92eebea4091bb2244c66db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.exe

Filesize
26KB

MD5
8f43b59aeb545a3d22043ec018ce8829

SHA1
172f517fa0df5ae3c1fb944ba45de4bfd90e7374

SHA256
cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4

SHA512
145375a0801a1dbd46719dd36f82ecf5d767df3bddb8539b5da3539e6c3d95f45907b1f3f8af734ae5b1c8670147c88db853e9af4e92eebea4091bb2244c66db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Trojan.vbe

Filesize
54B

MD5
89798bd7aee175ac99a9df9fbf02c15c

SHA1
46e865145ef82aad81c50d9f5e81c1c5d377bf57

SHA256
5d038b2443323018b94a75a05c525b95550384db3bfc68c80ba1d1912d0732ca

SHA512
c9ea14a2f74fb0a892901cc4470fedce95e19e8a70fea64b8d31f1ca2974028bebdb4e0a0fc0edfb399f836f0b56d42afde8a1b4614e7177d90c83beea55e066

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe

Filesize
26KB

MD5
8f43b59aeb545a3d22043ec018ce8829

SHA1
172f517fa0df5ae3c1fb944ba45de4bfd90e7374

SHA256
cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4

SHA512
145375a0801a1dbd46719dd36f82ecf5d767df3bddb8539b5da3539e6c3d95f45907b1f3f8af734ae5b1c8670147c88db853e9af4e92eebea4091bb2244c66db

Download Submit
\Users\Admin\AppData\Local\Temp\Trojan.exe

Filesize
26KB

MD5
8f43b59aeb545a3d22043ec018ce8829

SHA1
172f517fa0df5ae3c1fb944ba45de4bfd90e7374

SHA256
cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4

SHA512
145375a0801a1dbd46719dd36f82ecf5d767df3bddb8539b5da3539e6c3d95f45907b1f3f8af734ae5b1c8670147c88db853e9af4e92eebea4091bb2244c66db

Download Submit
\Users\Admin\AppData\Local\Temp\Trojan.exe

Filesize
26KB

MD5
8f43b59aeb545a3d22043ec018ce8829

SHA1
172f517fa0df5ae3c1fb944ba45de4bfd90e7374

SHA256
cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4

SHA512
145375a0801a1dbd46719dd36f82ecf5d767df3bddb8539b5da3539e6c3d95f45907b1f3f8af734ae5b1c8670147c88db853e9af4e92eebea4091bb2244c66db

Download Submit
\Users\Admin\AppData\Local\Temp\Trojan.exe

Filesize
26KB

MD5
8f43b59aeb545a3d22043ec018ce8829

SHA1
172f517fa0df5ae3c1fb944ba45de4bfd90e7374

SHA256
cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4

SHA512
145375a0801a1dbd46719dd36f82ecf5d767df3bddb8539b5da3539e6c3d95f45907b1f3f8af734ae5b1c8670147c88db853e9af4e92eebea4091bb2244c66db

Download Submit
\Users\Admin\AppData\Local\Temp\Trojan.exe

Filesize
26KB

MD5
8f43b59aeb545a3d22043ec018ce8829

SHA1
172f517fa0df5ae3c1fb944ba45de4bfd90e7374

SHA256
cab31420b0e52b11b33f73a0d0a33ab4e5654f010ff487193b80f59c4e2327a4

SHA512
145375a0801a1dbd46719dd36f82ecf5d767df3bddb8539b5da3539e6c3d95f45907b1f3f8af734ae5b1c8670147c88db853e9af4e92eebea4091bb2244c66db

Download Submit
memory/280-76-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download
memory/280-73-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download
memory/1188-65-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download
memory/1188-74-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download
memory/1552-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1552-55-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download
memory/1552-64-0x0000000073EB0000-0x000000007445B000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads