9f01d57b718a1da40519eb98333fd2ec2ca044c9d33a60311424dcff9142a2d3

Analysis

max time kernel
2s
max time network
130s
platform
windows7_x64
resource
win7-20220812-es
resource tags

arch:x64arch:x86image:win7-20220812-eslocale:es-esos:windows7-x64systemwindows
submitted
28-12-2022 21:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WhatsAppImage2012-02-21.exe
Size

710KB
MD5

8164f8d7e5ed7ca6457388ee60e1d2f7
SHA1

28cee1ce8b27865cd98274a177472b26f034ec4e
SHA256

11a2b60a677a0f234b9a3548b1920a426a734fdb2a932494715709d20e24e438
SHA512

bdca059472f2060b9d4c52d66e2efad5b14d7bbf1f83176b94e0fda4882acd186049a5b03ba9e40dd1081412d73ddb063366138a32c02253caa90b2c39608fc6
SSDEEP

12288:JRZ+IoG/n9IQxW3OBsFtPW72ia1Uqxay6WiPxXy1ccOoxoBo6tyOp1bbQQ/Au/2x:B2G/nvxW3WVaF1Uqx96WiNI7oBoUyOpY

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
964	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 13 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	964	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 608 wrote to memory of 1872	608	WhatsAppImage2012-02-21.exe	28
PID 608 wrote to memory of 1872	608	WhatsAppImage2012-02-21.exe	28
PID 608 wrote to memory of 1872	608	WhatsAppImage2012-02-21.exe	28
PID 608 wrote to memory of 1872	608	WhatsAppImage2012-02-21.exe	28
PID 1872 wrote to memory of 964	1872	cmd.exe	30
PID 1872 wrote to memory of 964	1872	cmd.exe	30
PID 1872 wrote to memory of 964	1872	cmd.exe	30
PID 1872 wrote to memory of 964	1872	cmd.exe	30
PID 1872 wrote to memory of 904	1872	cmd.exe	32
PID 1872 wrote to memory of 904	1872	cmd.exe	32
PID 1872 wrote to memory of 904	1872	cmd.exe	32
PID 1872 wrote to memory of 904	1872	cmd.exe	32
PID 1872 wrote to memory of 1916	1872	cmd.exe	33
PID 1872 wrote to memory of 1916	1872	cmd.exe	33
PID 1872 wrote to memory of 1916	1872	cmd.exe	33
PID 1872 wrote to memory of 1916	1872	cmd.exe	33
PID 1872 wrote to memory of 1800	1872	cmd.exe	34
PID 1872 wrote to memory of 1800	1872	cmd.exe	34
PID 1872 wrote to memory of 1800	1872	cmd.exe	34
PID 1872 wrote to memory of 1800	1872	cmd.exe	34
PID 1872 wrote to memory of 1108	1872	cmd.exe	45
PID 1872 wrote to memory of 1108	1872	cmd.exe	45
PID 1872 wrote to memory of 1108	1872	cmd.exe	45
PID 1872 wrote to memory of 1108	1872	cmd.exe	45
PID 1872 wrote to memory of 912	1872	cmd.exe	44
PID 1872 wrote to memory of 912	1872	cmd.exe	44
PID 1872 wrote to memory of 912	1872	cmd.exe	44
PID 1872 wrote to memory of 912	1872	cmd.exe	44
PID 1872 wrote to memory of 1256	1872	cmd.exe	43
PID 1872 wrote to memory of 1256	1872	cmd.exe	43
PID 1872 wrote to memory of 1256	1872	cmd.exe	43
PID 1872 wrote to memory of 1256	1872	cmd.exe	43
PID 1872 wrote to memory of 1768	1872	cmd.exe	35
PID 1872 wrote to memory of 1768	1872	cmd.exe	35
PID 1872 wrote to memory of 1768	1872	cmd.exe	35
PID 1872 wrote to memory of 1768	1872	cmd.exe	35
PID 1872 wrote to memory of 1348	1872	cmd.exe	40
PID 1872 wrote to memory of 1348	1872	cmd.exe	40
PID 1872 wrote to memory of 1348	1872	cmd.exe	40
PID 1872 wrote to memory of 1348	1872	cmd.exe	40
PID 1872 wrote to memory of 1388	1872	cmd.exe	39
PID 1872 wrote to memory of 1388	1872	cmd.exe	39
PID 1872 wrote to memory of 1388	1872	cmd.exe	39
PID 1872 wrote to memory of 1388	1872	cmd.exe	39
PID 1872 wrote to memory of 1776	1872	cmd.exe	38
PID 1872 wrote to memory of 1776	1872	cmd.exe	38
PID 1872 wrote to memory of 1776	1872	cmd.exe	38
PID 1872 wrote to memory of 1776	1872	cmd.exe	38
PID 1872 wrote to memory of 1628	1872	cmd.exe	37
PID 1872 wrote to memory of 1628	1872	cmd.exe	37
PID 1872 wrote to memory of 1628	1872	cmd.exe	37
PID 1872 wrote to memory of 1628	1872	cmd.exe	37
PID 1872 wrote to memory of 2024	1872	cmd.exe	36
PID 1872 wrote to memory of 2024	1872	cmd.exe	36
PID 1872 wrote to memory of 2024	1872	cmd.exe	36
PID 1872 wrote to memory of 2024	1872	cmd.exe	36
PID 1872 wrote to memory of 1168	1872	cmd.exe	41
PID 1872 wrote to memory of 1168	1872	cmd.exe	41
PID 1872 wrote to memory of 1168	1872	cmd.exe	41
PID 1872 wrote to memory of 1168	1872	cmd.exe	41
PID 1872 wrote to memory of 1980	1872	cmd.exe	42
PID 1872 wrote to memory of 1980	1872	cmd.exe	42
PID 1872 wrote to memory of 1980	1872	cmd.exe	42
PID 1872 wrote to memory of 1980	1872	cmd.exe	42

C:\Users\Admin\AppData\Local\Temp\WhatsAppImage2012-02-21.exe
"C:\Users\Admin\AppData\Local\Temp\WhatsAppImage2012-02-21.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:608
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\android.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM explorer.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:964
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://netlide.com/lol
    3⤵
    - Modifies Internet Explorer settings
    PID:904
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:904 CREDAT:1651713 /prefetch:2
      4⤵
      PID:1692
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:1916
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:1768
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2024
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:1628
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:1388
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:1348
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:1168
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:1256
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:912
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:1108
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:1072
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=xbs7FT7dXYc
    3⤵
    PID:1084
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1084 CREDAT:275457 /prefetch:2
      4⤵
      PID:3588
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=AHuzP7kambs
    3⤵
    PID:1684
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
      4⤵
      PID:3160
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=zHzUcE2mi9I
    3⤵
    PID:1336
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:2
      4⤵
      PID:3668
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=hY7m5jjJ9mM
    3⤵
    PID:1928
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
      4⤵
      PID:1952
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=F9d76h672HU
    3⤵
    PID:1836
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1836 CREDAT:275457 /prefetch:2
      4⤵
      PID:3084
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=xbs7FT7dXYc
    3⤵
    PID:1724
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
      4⤵
      PID:3612
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=AHuzP7kambs
    3⤵
    PID:1896
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1896 CREDAT:275457 /prefetch:2
      4⤵
      PID:4112
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=zHzUcE2mi9I
    3⤵
    PID:1296
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1296 CREDAT:275457 /prefetch:2
      4⤵
      PID:3660
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=hY7m5jjJ9mM
    3⤵
    PID:1796
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1796 CREDAT:275457 /prefetch:2
      4⤵
      PID:3820
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=F9d76h672HU
    3⤵
    PID:1528
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:275457 /prefetch:2
      4⤵
      PID:3676
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=xbs7FT7dXYc
    3⤵
    PID:1608
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1608 CREDAT:275457 /prefetch:2
      4⤵
      PID:3600
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=AHuzP7kambs
    3⤵
    PID:1756
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:2
      4⤵
      PID:4056
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=zHzUcE2mi9I
    3⤵
    PID:1540
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1540 CREDAT:275457 /prefetch:2
      4⤵
      PID:3652
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=hY7m5jjJ9mM
    3⤵
    PID:864
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:864 CREDAT:275457 /prefetch:2
      4⤵
      PID:3684
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=F9d76h672HU
    3⤵
    PID:1328
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1328 CREDAT:275457 /prefetch:2
      4⤵
      PID:4120
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=xbs7FT7dXYc
    3⤵
    PID:1592
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1592 CREDAT:275457 /prefetch:2
      4⤵
      PID:3496
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=AHuzP7kambs
    3⤵
    PID:1320
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1320 CREDAT:275457 /prefetch:2
      4⤵
      PID:3808
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=zHzUcE2mi9I
    3⤵
    PID:1832
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1832 CREDAT:275457 /prefetch:2
      4⤵
      PID:3504
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=hY7m5jjJ9mM
    3⤵
    PID:1552
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1552 CREDAT:275457 /prefetch:2
      4⤵
      PID:3788
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:1000
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:276
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2060
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2092
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=F9d76h672HU
    3⤵
    PID:776
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:776 CREDAT:275457 /prefetch:2
      4⤵
      PID:3540
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2144
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2132
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2184
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2196
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2228
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2264
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2280
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2308
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2816
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2852
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2944
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2072
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:3056
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:3016
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2964
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2880
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2804
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2600
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2828
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:3052
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:1548
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:792
- - C:\Windows\SysWOW64\notepad.exe
    notepad
    3⤵
    PID:2016
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2236
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:1956
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:3040
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:3028
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:2076
- - C:\Windows\SysWOW64\calc.exe
    calc
    3⤵
    PID:1728
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/watch?v=AHuzP7kambs
    3⤵
    PID:3208
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3208 CREDAT:275457 /prefetch:2
      4⤵
      PID:4272

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9822fda30e0d3237752e47f5935e798

SHA1
9a68f0e747dc071b17e6f8d183b3a2c807dc1fdb

SHA256
a274b19efc32c3193fc2156e6215009d8555d12cd45b8509f5998ccf8b8a44a4

SHA512
9a1351f78565911376a5a98c00f10eec774d4b6f2f680b4eef2a1016b2c10212c6d0bf46c3a3859fbf5db662e30b3128c3466888cd6b3e4d0192147f2453e42c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{98C11F61-86FB-11ED-88F1-EE38AA991E65}.dat

Filesize
5KB

MD5
18631f82731fd5a11c8058fffa89a8cd

SHA1
9f5ba916da64d5ee015b8d160ab6f32871859025

SHA256
7f946c7f736b4d1164e8c018bae30f78146fd576c3aa6a7570a194cebd4dce2b

SHA512
2559bcbac432b3b0a64bfc482e6dde35545142d9c906427ad0e01bdbc7ef30f6c0bf5aa841a5b082aa368ebce4b2ad81852e2226018c813c72368a494cf5638a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{98C11F61-86FB-11ED-88F1-EE38AA991E65}.dat

Filesize
5KB

MD5
0a940601fdb151be43451fc6298e6cc8

SHA1
f615eab62ae7f4cd5ebd35459153ea591f5b9da8

SHA256
a9a165d16c33ad5141740c3d428f18ca3112b84a985502bf010719acaeb61d1c

SHA512
36a5b3340fb2c29ee0589349f5cb0d0c0ede0e4de05e169b51e875e8a24d44ddf1911cbe4c2e88f39734492816ecc59b3b93928fd766072ea48309708886771e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{9964B261-86FB-11ED-88F1-EE38AA991E65}.dat

Filesize
4KB

MD5
b3171c68e69cbf5b0cd665e4a4641105

SHA1
a8d19e5da285b372cde699c4e57182094d0818f0

SHA256
cf70dea2a392a5d28621ac212aa2ffa0847b80a4ff387113007d6147dbd5b240

SHA512
bc3932fb402f83b11d18d05005d12ba3489b5dae3fdd37be0ce1469374493b20cb56fd511a04ddcecefc0e35c9456ce9e2620fa7a8d1d3812d2e14dcdc804573

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B9599AE0-86FB-11ED-88F1-EE38AA991E65}.dat

Filesize
3KB

MD5
e266a4c481647242660614bc4fc23f51

SHA1
7e0fa18408d0cde3beb0ace368a3f4afc1a4ab8c

SHA256
b5dae136cff9d3df57c6a865676146f31cf1687843bd5950376ed567d580a48c

SHA512
450f41d0364a19000b53e2b73e50d26b6a3aa2d05b22f4c2ec18a66cda858230b1872733bf2d58b05f9ea84e49386c666ea8f47eded051e322a1281ace467621

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\android.bat

Filesize
2KB

MD5
4cc4a826562c75f785924e8489167f5b

SHA1
a1c08aa5b27700b0e079fac424318e4fa0022cc7

SHA256
6a504abe4cb517883d37a9dc868133dadae35895a4e0a52bf86dfcbc0c97014a

SHA512
0947accb86a9ccb7e2d693d840d33ad7cb6ab6bde5ade7f3577e7ed2e7954dd50d1097b483c92fb14d0dd9437ae1bbac72b2a3a45e47724c8f9d1d6008278ec0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EG0KAH1Q.txt

Filesize
608B

MD5
304b244ae8b594b28ac6ac734bab5b25

SHA1
028dbec037768c73df16c8b711d74a25abeaf767

SHA256
ad1ae0ab5656b771cf7ce8c1078f0fd5db64a132956ebfeaf6ac4cd7d9cee0c8

SHA512
f906dd7cc3bccdc36771cf1b9e10e8d0f2ef5a5e8713cecb858e995c6b33fe9184f72a324363a40e372a524ca753411ab969df37c3f80a9a1cef598c90ec6158

Download Submit
memory/608-54-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download