c0205593654513ad8e334501eaee9c0b114eb6c91973d3f7929b644b0a87966d

Analysis

max time kernel
141s
max time network
32s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
14-03-2023 04:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc6f6b1e79077b230c5189cc30136267.exe
Size

677KB
MD5

bc6f6b1e79077b230c5189cc30136267
SHA1

392f800a93e6c8eef39bb2558d9aa1c90551fb7a
SHA256

c0205593654513ad8e334501eaee9c0b114eb6c91973d3f7929b644b0a87966d
SHA512

f51abda84870f41ffdd8e87030bdc79a1c5fae1e5399f004a4c5cc4c51b76d2a9a92c5143a886f0fa36753c27a6e3d048a320f9e537f1852b705cb193e17b53d
SSDEEP

12288:Yb1NwuGkcEah4/auHFkrfQ0VhP9ozLkSRr:YbRpO4/aulKQOo/kSt

Score

7^/10

adware discovery persistence stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

MSI78CC.tmp

pid process

1736 MSI78CC.tmp

pid	process
1736	MSI78CC.tmp

Loads dropped DLL 13 IoCs

Processes:

MsiExec.exemsiexec.exerundll32.exevcredist_x86.exeWerFault.exe

pid	process
868	MsiExec.exe
868	MsiExec.exe
1924	msiexec.exe
868	MsiExec.exe
1352	rundll32.exe
1352	rundll32.exe
1352	rundll32.exe
1352	rundll32.exe
1352	rundll32.exe
1352	rundll32.exe
1692	vcredist_x86.exe
1044	WerFault.exe
1044	WerFault.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

rundll32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0044-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0049-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0081-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0039-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0074-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0035-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0027-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0052-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0011-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0057-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0000-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0040-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0029-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0073-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0055-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0005-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0025-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0093-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0000-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0020-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0080-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0048-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0023-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0035-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0046-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0069-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0065-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0046-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0047-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0060-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0048-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0073-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0050-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0009-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0000-0001-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0036-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0048-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0001-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0047-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0037-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0026-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0001-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0038-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0063-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0024-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

vcredist_x86.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vcredist_x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f} = "\"C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\vcredist_x86.exe\" /burn.log.append \"C:\\Users\\Admin\\AppData\\Local\\Temp\\dd_vcredist_x86_20230314042224.log\" /uninstall /quiet /norestart ignored /burn.runonce"	vcredist_x86.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

rundll32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435B-BC74-9C25C1C588A9}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}	rundll32.exe

AutoIT Executable 7 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/1468-56-0x00000000002F0000-0x000000000045E000-memory.dmp	autoit_exe
behavioral1/memory/1468-55-0x00000000002F0000-0x000000000045E000-memory.dmp	autoit_exe
behavioral1/memory/1468-54-0x00000000002F0000-0x000000000045E000-memory.dmp	autoit_exe
behavioral1/memory/1468-57-0x00000000002F0000-0x000000000045E000-memory.dmp	autoit_exe
behavioral1/memory/1468-59-0x00000000002F0000-0x000000000045E000-memory.dmp	autoit_exe
behavioral1/memory/1468-130-0x00000000002F0000-0x000000000045E000-memory.dmp	autoit_exe
behavioral1/memory/1468-148-0x00000000002F0000-0x000000000045E000-memory.dmp	autoit_exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Halifax	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Qyzylorda	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-2	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jp2launcher.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Gambier	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Makassar	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\sound.properties	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Chuuk	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\El_Aaiun	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Cayenne	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Monterrey	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Baku	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\JavaAccessBridge-64.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\PST8PDT	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Bahia_Banderas	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Cayman	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Winnipeg	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Eirunepe	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Luxembourg	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Louisville	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\tzmappings	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\London	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Marengo	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\JdbcOdbc.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\images\cursors\win32_MoveDrop32x32.gif	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\ZoneInfoMappings	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Guyana	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Port_of_Spain	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Kaliningrad	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\blacklist	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Ulaanbaatar	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Broken_Hill	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jce.jar	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\HST	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\MST7MDT	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Costa_Rica	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Miquelon	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\javafx-iio.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\sunjce_provider.jar	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Fiji	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\SystemV\CST6	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\El_Salvador	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Guayaquil	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Menominee	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Antigua	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Paramaribo	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+2	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\Welcome.html	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Nassau	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Paris	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\fontconfig.bfc	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Hovd	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Tirane	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-13	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\server\classes.jsa	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\bin\JAWTAccessBridge-64.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Africa\Ndjamena	msiexec.exe

Drops file in Windows directory 12 IoCs

Processes:

vcredist_x86.exeDrvInst.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\WindowsUpdate.log	vcredist_x86.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5E67.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI788D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79F5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6c5958.ipi	msiexec.exe
File created	C:\Windows\Installer\6c5958.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5E57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI78CC.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1044 1692 WerFault.exe vcredist_x86.exe

pid	pid_target	process	target process
1044	1692	WerFault.exe	vcredist_x86.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppName	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\AppPath	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\Policy = "19"	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8FE2181-CAE7-49EE-9B04-DB7EB4DA544A}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{44D1B085-E495-4B5F-9EE6-34795C46E7E7}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5852F5ED-8BF4-11D4-A245-0080C6F74284}	rundll32.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

DrvInst.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\p2pcollab.dll,-8042 = "Peer to Peer Trust"	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\qagentrt.dll,-10 = "System Health Authentication"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2e\52C64B7E	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption"	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

rundll32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0032-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0036-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0070-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0065-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0014-0001-0002-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0075-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{E19F9331-3110-11D4-991C-005004D3B3DB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0009-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0027-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0048-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0069-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0014-0001-0001-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0013-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0076-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0001-0006-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0058-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0064-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0064-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0083-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0061-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0069-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0058-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0075-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0024-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0022-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0031-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0007-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0008-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0010-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0046-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0059-ABCDEFFEDCBA}	rundll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5852F5ED-8BF4-11D4-A245-0080C6F74284}\MiscStatus	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0038-ABCDEFFEDCBC}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0042-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0064-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0014-0002-0039-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0012-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0044-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0072-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0082-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0067-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0017-0000-0024-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0006-ABCDEFFEDCBA}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0024-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0053-ABCDEFFEDCBC}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0068-ABCDEFFEDCBB}	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0015-0000-0054-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000_CLASSES\CLSID\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBB}\INPROCSERVER32	rundll32.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

bc6f6b1e79077b230c5189cc30136267.exeMSI78CC.tmp

pid	process
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1468	bc6f6b1e79077b230c5189cc30136267.exe
1736	MSI78CC.tmp

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exeMSI78CC.tmprundll32.exe

description	pid	process
Token: SeShutdownPrivilege	1688	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeTakeOwnershipPrivilege	1924	msiexec.exe
Token: SeSecurityPrivilege	1924	msiexec.exe
Token: SeCreateTokenPrivilege	1688	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1688	msiexec.exe
Token: SeLockMemoryPrivilege	1688	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1688	msiexec.exe
Token: SeMachineAccountPrivilege	1688	msiexec.exe
Token: SeTcbPrivilege	1688	msiexec.exe
Token: SeSecurityPrivilege	1688	msiexec.exe
Token: SeTakeOwnershipPrivilege	1688	msiexec.exe
Token: SeLoadDriverPrivilege	1688	msiexec.exe
Token: SeSystemProfilePrivilege	1688	msiexec.exe
Token: SeSystemtimePrivilege	1688	msiexec.exe
Token: SeProfSingleProcessPrivilege	1688	msiexec.exe
Token: SeIncBasePriorityPrivilege	1688	msiexec.exe
Token: SeCreatePagefilePrivilege	1688	msiexec.exe
Token: SeCreatePermanentPrivilege	1688	msiexec.exe
Token: SeBackupPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1688	msiexec.exe
Token: SeShutdownPrivilege	1688	msiexec.exe
Token: SeDebugPrivilege	1688	msiexec.exe
Token: SeAuditPrivilege	1688	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1688	msiexec.exe
Token: SeChangeNotifyPrivilege	1688	msiexec.exe
Token: SeRemoteShutdownPrivilege	1688	msiexec.exe
Token: SeUndockPrivilege	1688	msiexec.exe
Token: SeSyncAgentPrivilege	1688	msiexec.exe
Token: SeEnableDelegationPrivilege	1688	msiexec.exe
Token: SeManageVolumePrivilege	1688	msiexec.exe
Token: SeImpersonatePrivilege	1688	msiexec.exe
Token: SeCreateGlobalPrivilege	1688	msiexec.exe
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeTakeOwnershipPrivilege	1924	msiexec.exe
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeTakeOwnershipPrivilege	1924	msiexec.exe
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeTakeOwnershipPrivilege	1924	msiexec.exe
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeTakeOwnershipPrivilege	1924	msiexec.exe
Token: SeDebugPrivilege	1736	MSI78CC.tmp
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeTakeOwnershipPrivilege	1924	msiexec.exe
Token: SeBackupPrivilege	1352	rundll32.exe
Token: SeRestorePrivilege	1352	rundll32.exe
Token: SeBackupPrivilege	1352	rundll32.exe
Token: SeRestorePrivilege	1352	rundll32.exe
Token: SeBackupPrivilege	1352	rundll32.exe
Token: SeRestorePrivilege	1352	rundll32.exe
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeTakeOwnershipPrivilege	1924	msiexec.exe
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeTakeOwnershipPrivilege	1924	msiexec.exe
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeTakeOwnershipPrivilege	1924	msiexec.exe
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeTakeOwnershipPrivilege	1924	msiexec.exe
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeTakeOwnershipPrivilege	1924	msiexec.exe
Token: SeRestorePrivilege	1924	msiexec.exe
Token: SeTakeOwnershipPrivilege	1924	msiexec.exe
Token: SeRestorePrivilege	1924	msiexec.exe

Suspicious use of WriteProcessMemory 40 IoCs

Processes:

bc6f6b1e79077b230c5189cc30136267.execmd.exemsiexec.exevcredist_x86.exevcredist_x86.exe

description	pid	process	target process
PID 1468 wrote to memory of 460	1468	bc6f6b1e79077b230c5189cc30136267.exe	cmd.exe
PID 1468 wrote to memory of 460	1468	bc6f6b1e79077b230c5189cc30136267.exe	cmd.exe
PID 1468 wrote to memory of 460	1468	bc6f6b1e79077b230c5189cc30136267.exe	cmd.exe
PID 1468 wrote to memory of 460	1468	bc6f6b1e79077b230c5189cc30136267.exe	cmd.exe
PID 460 wrote to memory of 1688	460	cmd.exe	msiexec.exe
PID 460 wrote to memory of 1688	460	cmd.exe	msiexec.exe
PID 460 wrote to memory of 1688	460	cmd.exe	msiexec.exe
PID 460 wrote to memory of 1688	460	cmd.exe	msiexec.exe
PID 460 wrote to memory of 1688	460	cmd.exe	msiexec.exe
PID 460 wrote to memory of 1688	460	cmd.exe	msiexec.exe
PID 460 wrote to memory of 1688	460	cmd.exe	msiexec.exe
PID 1924 wrote to memory of 868	1924	msiexec.exe	MsiExec.exe
PID 1924 wrote to memory of 868	1924	msiexec.exe	MsiExec.exe
PID 1924 wrote to memory of 868	1924	msiexec.exe	MsiExec.exe
PID 1924 wrote to memory of 868	1924	msiexec.exe	MsiExec.exe
PID 1924 wrote to memory of 868	1924	msiexec.exe	MsiExec.exe
PID 1924 wrote to memory of 1736	1924	msiexec.exe	MSI78CC.tmp
PID 1924 wrote to memory of 1736	1924	msiexec.exe	MSI78CC.tmp
PID 1924 wrote to memory of 1736	1924	msiexec.exe	MSI78CC.tmp
PID 1924 wrote to memory of 1352	1924	msiexec.exe	rundll32.exe
PID 1924 wrote to memory of 1352	1924	msiexec.exe	rundll32.exe
PID 1924 wrote to memory of 1352	1924	msiexec.exe	rundll32.exe
PID 1468 wrote to memory of 1104	1468	bc6f6b1e79077b230c5189cc30136267.exe	vcredist_x86.exe
PID 1468 wrote to memory of 1104	1468	bc6f6b1e79077b230c5189cc30136267.exe	vcredist_x86.exe
PID 1468 wrote to memory of 1104	1468	bc6f6b1e79077b230c5189cc30136267.exe	vcredist_x86.exe
PID 1468 wrote to memory of 1104	1468	bc6f6b1e79077b230c5189cc30136267.exe	vcredist_x86.exe
PID 1468 wrote to memory of 1104	1468	bc6f6b1e79077b230c5189cc30136267.exe	vcredist_x86.exe
PID 1468 wrote to memory of 1104	1468	bc6f6b1e79077b230c5189cc30136267.exe	vcredist_x86.exe
PID 1468 wrote to memory of 1104	1468	bc6f6b1e79077b230c5189cc30136267.exe	vcredist_x86.exe
PID 1104 wrote to memory of 1692	1104	vcredist_x86.exe	vcredist_x86.exe
PID 1104 wrote to memory of 1692	1104	vcredist_x86.exe	vcredist_x86.exe
PID 1104 wrote to memory of 1692	1104	vcredist_x86.exe	vcredist_x86.exe
PID 1104 wrote to memory of 1692	1104	vcredist_x86.exe	vcredist_x86.exe
PID 1104 wrote to memory of 1692	1104	vcredist_x86.exe	vcredist_x86.exe
PID 1104 wrote to memory of 1692	1104	vcredist_x86.exe	vcredist_x86.exe
PID 1104 wrote to memory of 1692	1104	vcredist_x86.exe	vcredist_x86.exe
PID 1692 wrote to memory of 1044	1692	vcredist_x86.exe	WerFault.exe
PID 1692 wrote to memory of 1044	1692	vcredist_x86.exe	WerFault.exe
PID 1692 wrote to memory of 1044	1692	vcredist_x86.exe	WerFault.exe
PID 1692 wrote to memory of 1044	1692	vcredist_x86.exe	WerFault.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\bc6f6b1e79077b230c5189cc30136267.exe
"C:\Users\Admin\AppData\Local\Temp\bc6f6b1e79077b230c5189cc30136267.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1468

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F06417080FF} /quiet /norestart
2⤵
- Suspicious use of WriteProcessMemory
PID:460

C:\Windows\SysWOW64\msiexec.exe
msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F06417080FF} /quiet /norestart
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /quiet /norestart
2⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1104

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe
"C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\vcredist_x86.exe" /uninstall /quiet /norestart -burn.unelevated BurnPipe.{990ED895-A80F-4D44-BE61-EAACF445AF4D} {07821BC4-5B85-4CEB-B81B-302D83BFF26B} 1104
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 348
4⤵
- Loads dropped DLL
- Program crash
PID:1044

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding 24C791C9A49FD43376A35317188C32B7
2⤵
- Loads dropped DLL
PID:868

C:\Windows\Installer\MSI78CC.tmp
"C:\Windows\Installer\MSI78CC.tmp" C:\Program Files\Java\jre7\;C;2
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1736

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Program Files\Java\jre7\bin\\installer.dll",UninstallJREEntryPoint
2⤵
- Loads dropped DLL
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1352

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1548

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000002B8" "00000000000002B4"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2008

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\6c5959.rbs
Filesize
112KB

MD5
78dcd0b22cda12d585a84a675320d2e4

SHA1
9f8477e8d7eff5ac8feefbe4a55470cb0864623c

SHA256
f2622b61afd656f3d958a6a04fd3059c38194aab0d74eaab5e76c07290df92e0

SHA512
fec947820cf133fd41b2a211aeeecfb4782251abdaab3c585fceea0aab0b7029412c34659c4375e79e26f732afec488960b6cb72da4bb566cc63827ce4651566

Download Submit
C:\Users\Admin\AppData\Local\Temp\java_install_reg.log
Filesize
4KB

MD5
0be6c0df8bb2be40cc116e44f48318bd

SHA1
fa9b1631a4511cbc7b1cebc601d7f17a761972ef

SHA256
3caf54a821f97bd1c50ab6eccc6bd4404cf22917e30e214134f27b44d89708b3

SHA512
934a529f6c4d7b27fae6edf5da9f44855af3e477e867cc4a8c2172140c699a01c3952441879d068edd05b7a510f67174e5c31755be644d859b945401b2d43c63

Download Submit
C:\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\logo.png
Filesize
1KB

MD5
d6bd210f227442b3362493d046cea233

SHA1
ff286ac8370fc655aea0ef35e9cf0bfcb6d698de

SHA256
335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef

SHA512
464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b

Download Submit
C:\Windows\Installer\MSI5E67.tmp
Filesize
235KB

MD5
16cae7c3dce97c9ab1c1519383109141

SHA1
10e29384e2df609caea7a3ce9f63724b1c248479

SHA256
8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

SHA512
5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

Download Submit
C:\Windows\Installer\MSI788D.tmp
Filesize
235KB

MD5
16cae7c3dce97c9ab1c1519383109141

SHA1
10e29384e2df609caea7a3ce9f63724b1c248479

SHA256
8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

SHA512
5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

Download Submit
C:\Windows\Installer\MSI78CC.tmp
Filesize
309KB

MD5
8b285b5164ac3dbd6f6c97c81c77fb59

SHA1
2d846f00f4a1533d93d9f7fcf797cf406b7a79e5

SHA256
7c932b844dd505281a0eb1e3cb3c1b27be9ca47866655cc3bfd6ae660d4f6b2c

SHA512
2669938f68238a5e68accdd2c3f7dcdbafacd58e00418f32769bd452580e4a4fa0169b001652801ec3ec0ec67f093997a87f1bb80bd83c20cbf1145d3249e2b8

Download Submit
C:\Windows\Installer\MSI79F5.tmp
Filesize
235KB

MD5
16cae7c3dce97c9ab1c1519383109141

SHA1
10e29384e2df609caea7a3ce9f63724b1c248479

SHA256
8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

SHA512
5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

Download Submit
C:\Windows\Installer\MSI79F5.tmp
Filesize
235KB

MD5
16cae7c3dce97c9ab1c1519383109141

SHA1
10e29384e2df609caea7a3ce9f63724b1c248479

SHA256
8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

SHA512
5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

Download Submit
\Program Files\Java\jre7\bin\deploy.dll
Filesize
481KB

MD5
2b652299b9967a6d7f9c321b04cd9c5b

SHA1
f26f9e22a1ba45fc5fd68b975889a1a637781056

SHA256
26b9a76128153429f3f5d668b134fe3c14b8b8430ae0e671191033bdda296097

SHA512
4e0bd2a70b6f82eb2ab80d5992d65455defb3b38021231e3d7cafa63e82634661bf9aa9eaee3b3e26d03c60fdc6666a59bdeee8c0bab0ef12740de6727366c2b

Download Submit
\Program Files\Java\jre7\bin\installer.dll
Filesize
235KB

MD5
16cae7c3dce97c9ab1c1519383109141

SHA1
10e29384e2df609caea7a3ce9f63724b1c248479

SHA256
8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

SHA512
5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

Download Submit
\Program Files\Java\jre7\bin\installer.dll
Filesize
235KB

MD5
16cae7c3dce97c9ab1c1519383109141

SHA1
10e29384e2df609caea7a3ce9f63724b1c248479

SHA256
8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

SHA512
5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

Download Submit
\Program Files\Java\jre7\bin\installer.dll
Filesize
235KB

MD5
16cae7c3dce97c9ab1c1519383109141

SHA1
10e29384e2df609caea7a3ce9f63724b1c248479

SHA256
8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

SHA512
5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

Download Submit
\Program Files\Java\jre7\bin\installer.dll
Filesize
235KB

MD5
16cae7c3dce97c9ab1c1519383109141

SHA1
10e29384e2df609caea7a3ce9f63724b1c248479

SHA256
8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

SHA512
5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

Download Submit
\Program Files\Java\jre7\bin\wsdetect.dll
Filesize
187KB

MD5
a06336b79db4da78f4af955e26f7c0c6

SHA1
3c24fb0f8bf38999ccffc75a0f5710878bc40fc1

SHA256
2d96fc7ddb77288f05b78340cf6ac85dd604a2e5d53d6fcb825eead1a9b008d8

SHA512
c664e9259db49075cedd933f64ab4247384a117c5be609958e440a44cf2bfba13a10ade36f7c8bcacdec063c3ca63b3c70c5392e5b7d2ea02fd5be06a62c180a

Download Submit
\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
Filesize
126KB

MD5
d7bf29763354eda154aad637017b5483

SHA1
dfa7d296bfeecde738ef4708aaabfebec6bc1e48

SHA256
7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93

SHA512
1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c

Download Submit
\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
Filesize
126KB

MD5
d7bf29763354eda154aad637017b5483

SHA1
dfa7d296bfeecde738ef4708aaabfebec6bc1e48

SHA256
7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93

SHA512
1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c

Download Submit
\Users\Admin\AppData\Local\Temp\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\.ba1\wixstdba.dll
Filesize
126KB

MD5
d7bf29763354eda154aad637017b5483

SHA1
dfa7d296bfeecde738ef4708aaabfebec6bc1e48

SHA256
7f5f8fcfd84132579f07e395e65b44e1b031fe01a299bce0e3dd590131c5cb93

SHA512
1c76175732fe68b9b12cb46077daa21e086041adbd65401717a9a1b5f3c516e03c35a90897c22c7281647d6af4a1a5ffb3fbd5706ea376d8f6e574d27396019c

Download Submit
\Windows\Installer\MSI5E67.tmp
Filesize
235KB

MD5
16cae7c3dce97c9ab1c1519383109141

SHA1
10e29384e2df609caea7a3ce9f63724b1c248479

SHA256
8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

SHA512
5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

Download Submit
\Windows\Installer\MSI788D.tmp
Filesize
235KB

MD5
16cae7c3dce97c9ab1c1519383109141

SHA1
10e29384e2df609caea7a3ce9f63724b1c248479

SHA256
8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

SHA512
5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

Download Submit
\Windows\Installer\MSI78CC.tmp
Filesize
309KB

MD5
8b285b5164ac3dbd6f6c97c81c77fb59

SHA1
2d846f00f4a1533d93d9f7fcf797cf406b7a79e5

SHA256
7c932b844dd505281a0eb1e3cb3c1b27be9ca47866655cc3bfd6ae660d4f6b2c

SHA512
2669938f68238a5e68accdd2c3f7dcdbafacd58e00418f32769bd452580e4a4fa0169b001652801ec3ec0ec67f093997a87f1bb80bd83c20cbf1145d3249e2b8

Download Submit
\Windows\Installer\MSI79F5.tmp
Filesize
235KB

MD5
16cae7c3dce97c9ab1c1519383109141

SHA1
10e29384e2df609caea7a3ce9f63724b1c248479

SHA256
8acd0117c92da6b67baf5c1ae8a81adf47e5db4c2f58d3e197850a81a555d2c2

SHA512
5b8b803ddabbb46a8ae5f012f3b5adbbd8eb7d7edbd324095011e385e1e94b2c5e20a28f6c0b8dd89b8789106c02d41916e70e090fbc63edd845d75c6f210e69

Download Submit
memory/1468-58-0x0000000004690000-0x0000000004691000-memory.dmp

Filesize
4KB

Download
memory/1468-57-0x00000000002F0000-0x000000000045E000-memory.dmp

Filesize
1.4MB

Download
memory/1468-54-0x00000000002F0000-0x000000000045E000-memory.dmp

Filesize
1.4MB

Download
memory/1468-130-0x00000000002F0000-0x000000000045E000-memory.dmp

Filesize
1.4MB

Download
memory/1468-56-0x00000000002F0000-0x000000000045E000-memory.dmp

Filesize
1.4MB

Download
memory/1468-55-0x00000000002F0000-0x000000000045E000-memory.dmp

Filesize
1.4MB

Download
memory/1468-148-0x00000000002F0000-0x000000000045E000-memory.dmp

Filesize
1.4MB

Download
memory/1468-64-0x0000000004690000-0x0000000004691000-memory.dmp

Filesize
4KB

Download
memory/1468-59-0x00000000002F0000-0x000000000045E000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads