Analysis
- max time kernel
146s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system - submitted
09/01/2023, 12:41
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target file.exe
- Size 326KB
- Sample230109-pws2vahf3x
- SHA256 e8d80e726e802a57312c8a94e0c867c67481ba8da9abadc3dde6828040689cd8
- MD5 2c25efc7209726721d6f3a533ba0049c
- SHA1 e636f2b2457015262a1e7f65d0838c25a491f705
- SHA512 a0f96367e2ae647394197b4c2124d12c64d50d9a1f812894684cb84380b4726f714916737aaa565ad6674d753ce5a9e6396431528432d8e80e8171103d2cca7f
- SSDEEP 3072:NXOC8uMF/lGGQ88Aku5xgLIG8FmcZKfconX3sF3foEYRAymWsuTqdlAGWS96fY6R:JxeF/l3+ywccfcg8xMcWsued79AB++g
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detects Smokeloader packer 1 IoCs
resource yara_rule behavioral2/memory/4872-133-0x0000000002190000-0x0000000002199000-memory.dmp family_smokeloader - SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 3 IoCs
flow pid Process 27 2040 rundll32.exe 30 2040 rundll32.exe 60 2040 rundll32.exe - Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 1420 C364.exe - Loads dropped DLL 1 IoCs
pid Process 2040 rundll32.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2040 set thread context of 3648 2040 rundll32.exe 91 - Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files (x86)\WindowsPowerShell\Modules\cloud_icon.png rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\forms_distributed.gif rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\DefaultID.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Onix32.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\cloud_icon.png rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\review_browser.gif rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Onix32.dll rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\ACE.dll rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\snapshot_blob.bin rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\forms_distributed.gif rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\DefaultID.pdf rundll32.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\review_browser.gif rundll32.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 4752 1420 WerFault.exe 86 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI file.exe - Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Previous Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Component Information rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision rundll32.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 rundll32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Software\Microsoft\Internet Explorer\Toolbar Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Process not Found - Modifies registry class 30 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = ffffffff Process not Found Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic" Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 820074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f400009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4e003100000000002956386d100054656d7000003a0009000400efbe6b55586c29563d6d2e000000000000000000000000000000000000000000000000007c4c7000540065006d007000000014000000 Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 50003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\NodeSlot = "1" Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Process not Found Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\WorkFolders Process not Found Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU rundll32.exe Set value (data) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff rundll32.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1108 Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4872 file.exe 4872 file.exe 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found 1108 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1108 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4872 file.exe - Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 1108 Process not Found Token: SeCreatePagefilePrivilege 1108 Process not Found Token: SeShutdownPrivilege 1108 Process not Found Token: SeCreatePagefilePrivilege 1108 Process not Found Token: SeShutdownPrivilege 1108 Process not Found Token: SeCreatePagefilePrivilege 1108 Process not Found Token: SeShutdownPrivilege 1108 Process not Found Token: SeCreatePagefilePrivilege 1108 Process not Found Token: SeShutdownPrivilege 1108 Process not Found Token: SeCreatePagefilePrivilege 1108 Process not Found Token: SeShutdownPrivilege 1108 Process not Found Token: SeCreatePagefilePrivilege 1108 Process not Found Token: SeShutdownPrivilege 1108 Process not Found Token: SeCreatePagefilePrivilege 1108 Process not Found Token: SeShutdownPrivilege 1108 Process not Found Token: SeCreatePagefilePrivilege 1108 Process not Found Token: SeShutdownPrivilege 1108 Process not Found Token: SeCreatePagefilePrivilege 1108 Process not Found - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3648 rundll32.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1108 Process not Found 1108 Process not Found - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1108 wrote to memory of 1420 1108 Process not Found 86 PID 1108 wrote to memory of 1420 1108 Process not Found 86 PID 1108 wrote to memory of 1420 1108 Process not Found 86 PID 1420 wrote to memory of 2040 1420 C364.exe 88 PID 1420 wrote to memory of 2040 1420 C364.exe 88 PID 1420 wrote to memory of 2040 1420 C364.exe 88 PID 2040 wrote to memory of 3648 2040 rundll32.exe 91 PID 2040 wrote to memory of 3648 2040 rundll32.exe 91 PID 2040 wrote to memory of 3648 2040 rundll32.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4872
-
C:\Users\Admin\AppData\Local\Temp\C364.exeC:\Users\Admin\AppData\Local\Temp\C364.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp",Iyidwoiowsw2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 155913⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3648
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 5402⤵
- Program crash
PID:4752
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1420 -ip 14201⤵PID:1144
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4504
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k LocalService1⤵PID:2912
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "c:\program files (x86)\windowspowershell\modules\ace.dll",LSYH2⤵PID:2868
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\ACE.dll
- Size 714KB
- SHA256 149cd6837df72f86257b1d8cc38c0db90696f42f47e56153f035bfc5d9dd4e11
- MD5 96389d77eb1029293fe71d58251e636a
- SHA1 b10934484546a8b7cdaede283db73003ca0f8e96
- SHA512 6dcaa660abc3064ef136993d25f5aa0768923a78234cb78169cf8cf0313790f1b7ce6afcd7de8336b1339714dcfeb1d8a4b8789eee1718e44194fe33bfc8335f
- SSDEEP 12288:58jfuQWjK3lYRk52K/iAkyshv2zjTywBZmAUYiUy+Cz1yVBMjiItbNFNIJOI/rFu:58DWK3l4kkEPjfywBLTvFFMjiItbNrdr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\WindowsPowerShell\Modules\ACE.dll
- Size 714KB
- SHA256 149cd6837df72f86257b1d8cc38c0db90696f42f47e56153f035bfc5d9dd4e11
- MD5 96389d77eb1029293fe71d58251e636a
- SHA1 b10934484546a8b7cdaede283db73003ca0f8e96
- SHA512 6dcaa660abc3064ef136993d25f5aa0768923a78234cb78169cf8cf0313790f1b7ce6afcd7de8336b1339714dcfeb1d8a4b8789eee1718e44194fe33bfc8335f
- SSDEEP 12288:58jfuQWjK3lYRk52K/iAkyshv2zjTywBZmAUYiUy+Cz1yVBMjiItbNFNIJOI/rFu:58DWK3l4kkEPjfywBLTvFFMjiItbNrdr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\Microsoft.MSPaint_2019.729.2301.0_neutral_~_8wekyb3d8bbwe.xml
- Size 7KB
- SHA256 581fd3d9aa551599bd691b5b23cdc51c48f7f3a65955adf1e1d0fef0a8cfb8b8
- MD5 e585657cf3525fd22dad5e2409eb9e60
- SHA1 1c0b9d97bb93098e1d8a162b9725a0d6134dc913
- SHA512 601c03a19bb0d1170db8c3a05ff4a38d209e2ec53426b2048362504b75e3971f40480afd118cd741a52e69ba5a55c61dd4cc488f335be3d67584982009392ced
- SSDEEP 192:x7yLvg21SeJR/ADx9bqxH8FHZeTb6Nb9rxZb5K4ETEPvT7nRwfX7XZZ/CuD0dx1t:x7yLvg21SeJR/ADx9bqxH8FHZeTb6Nbt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe.xml
- Size 827B
- SHA256 df0af4b8242dcab107aab8d00add27b9797c00002669ff953667869abb6c77c6
- MD5 cf7d0dd53bde6261338a343a4a92c3f5
- SHA1 f5326546a46c8a7d2400d743fca320a166331757
- SHA512 9cf52da12c7e703fefff7a5295b7475d95a568d050b210a7b53470dad257793257a4242c89fb00fa22c7319c8be96144b193ec1e51c4d3a751af6765a6935148
- MD5 SHA1 SHA512
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\Policy.vpol
- Size 444B
- SHA256 b798f6c4bba8fe6fd7f4a7bf5f599d6de87ca2684d20487704573d1cf51e04d7
- MD5 9efac978d2adae06f8aa2408df220268
- SHA1 61b158f2f99663631b037e970461be3238a84302
- SHA512 534b2bda4bbc3e724444f4aee3b55a000dcef6d3a57e7c6e44bf588b1bc643b7a46e5e4823d835ee695d47e5ae680fcec9f21590c88e960603af5a795c1ec0b2
- MD5 SHA1 SHA512
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\Rwdfud.tmp
- Size 3.5MB
- SHA256 d458dc181fd21e5a1d0e3d51bf96010846e547f6580fd1f9d8b24e5f43a62cb2
- MD5 a042b795836f9422c330e47d67f10095
- SHA1 1b3d06231f805bc9fcffe45e931f278c8830a8fb
- SHA512 949cd5b5c32ba5c89b89f7861fc5887ad8814e0eb0380f724fb5b8fa5f72c88ece6878acf3cfdc6a51e5904b23ecca0415b7f3f72c82e2498ce5a1feb13a4b73
- SSDEEP 98304:vTfJ3ux/HTn7UipXeF9T5WqyI20RYrnrm:vLJK7rXe3Or3m
- MD5 SHA1 SHA512 SSDEEP
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\behavior.xml
- Size 1KB
- SHA256 7cfdc107f1bc076ca39ee36960bbb1d64a6c9faac9ba73a106f6e85224da4a1b
- MD5 6c23b0f54e5c427ff8f3db170b62616f
- SHA1 44f1d0f71cbab0e05d9a563bf9e92759898ca4e9
- SHA512 f511e1aa2f7dcac52ad5452ef8e9e403a77b55a6e9c7bf8248db00e85cee61f1e28ebe6470084a1f22cf64664b8a9ec84975afda1e26e348b4948de4583313a6
- MD5 SHA1 SHA512
- Path C:\ProgramData\{B7E8E476-349D-60AA-651B-798B40E3CAEC}\folder.ico
- Size 52KB
- SHA256 bef53904908769ceeb60f8e0976c3194e73534f00f4afb65497c2091121b98b2
- MD5 bbf9dbdc079c0cd95f78d728aa3912d4
- SHA1 051f76cc8c6520768bac9559bb329abeebd70d7c
- SHA512 af110c52c983f1cf55b3db7d375e03c8c9308e3cf9ee1c154c2b25cb3f8299f0c0ba87b47445f09f98659eb536184c245887a341733c11af713e9ecc15288b5d
- SSDEEP 1536:y3i6EBXR2n7dqnfiVDIHMPV0+l/SLOUp4:8eiVD+EmUSLOUp4
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\C364.exe
- Size 1.1MB
- SHA256 0749948b3bf98c2c5bc03060634d215542f87dab8a92677f1885cf0b9ea36f39
- MD5 e7f1a070a914352c8e80242c1618732b
- SHA1 669a862cdcad14ae1258c997f62f124c8fb1048f
- SHA512 18fbf494f375a2285f85774de8de75c2d89582e06b94c2a56266676a24e4b19c9a2e51afd0e039f01a48b142cfbe4661aba2b57e706d6f1cb527ac4b7d6d3faf
- SSDEEP 24576:M4bnmz5R+pP5sgf8XAbCZO6I2491tLsszU24UbqRRip4G+I:M4bgUxZf5bF6p4DreUuwp4dI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\C364.exe
- Size 1.1MB
- SHA256 0749948b3bf98c2c5bc03060634d215542f87dab8a92677f1885cf0b9ea36f39
- MD5 e7f1a070a914352c8e80242c1618732b
- SHA1 669a862cdcad14ae1258c997f62f124c8fb1048f
- SHA512 18fbf494f375a2285f85774de8de75c2d89582e06b94c2a56266676a24e4b19c9a2e51afd0e039f01a48b142cfbe4661aba2b57e706d6f1cb527ac4b7d6d3faf
- SSDEEP 24576:M4bnmz5R+pP5sgf8XAbCZO6I2491tLsszU24UbqRRip4G+I:M4bgUxZf5bF6p4DreUuwp4dI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp
- Size 714KB
- SHA256 d0ac0e9021c6e231c60256198309b7f72ce4c5e772cf343b5456c2ce0664b9bd
- MD5 9dd70d24b2657a9254b9fd536a4d06d5
- SHA1 348a1d210d7c4daef8ecdb692eadf3975971e8ee
- SHA512 dee5bfe83fdf196c78ee255e50a25994220ce9ecac22eb24323df70e668714d7a810b67ddace7809d9d7e2160a35c4603deedb64b1660d82dde58586c34d2ab6
- SSDEEP 12288:V8jfuQWjK3lYRk52K/iAkyshv2zjTywBZmAUYiUy+Cz1yVBMjiItbNFNIJOI/rFu:V8DWK3l4kkEPjfywBLTvFFMjiItbNrdr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Wtfoiq.tmp
- Size 714KB
- SHA256 d0ac0e9021c6e231c60256198309b7f72ce4c5e772cf343b5456c2ce0664b9bd
- MD5 9dd70d24b2657a9254b9fd536a4d06d5
- SHA1 348a1d210d7c4daef8ecdb692eadf3975971e8ee
- SHA512 dee5bfe83fdf196c78ee255e50a25994220ce9ecac22eb24323df70e668714d7a810b67ddace7809d9d7e2160a35c4603deedb64b1660d82dde58586c34d2ab6
- SSDEEP 12288:V8jfuQWjK3lYRk52K/iAkyshv2zjTywBZmAUYiUy+Cz1yVBMjiItbNFNIJOI/rFu:V8DWK3l4kkEPjfywBLTvFFMjiItbNrdr
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\program files (x86)\windowspowershell\modules\ace.dll
- Size 714KB
- SHA256 149cd6837df72f86257b1d8cc38c0db90696f42f47e56153f035bfc5d9dd4e11
- MD5 96389d77eb1029293fe71d58251e636a
- SHA1 b10934484546a8b7cdaede283db73003ca0f8e96
- SHA512 6dcaa660abc3064ef136993d25f5aa0768923a78234cb78169cf8cf0313790f1b7ce6afcd7de8336b1339714dcfeb1d8a4b8789eee1718e44194fe33bfc8335f
- SSDEEP 12288:58jfuQWjK3lYRk52K/iAkyshv2zjTywBZmAUYiUy+Cz1yVBMjiItbNFNIJOI/rFu:58DWK3l4kkEPjfywBLTvFFMjiItbNrdr
- MD5 SHA1 SHA512 SSDEEP