hxxps://drive[.]google[.]com/u/0/uc?id=1gB2CQFeZrXRXInGSOz-zPvyA0NYgIBU1&export=download

Analysis

max time kernel
150s
max time network
139s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
01/04/2023, 05:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://drive.google.com/u/0/uc?id=1gB2CQFeZrXRXInGSOz-zPvyA0NYgIBU1&export=download

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
37	1040	msiexec.exe
39	1040	msiexec.exe
41	1040	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
888	jdk-8u191-windows-i586.exe
428	jdk-8u191-windows-i586.exe

Loads dropped DLL 4 IoCs

pid	Process
888	jdk-8u191-windows-i586.exe
1608	MsiExec.exe
1608	MsiExec.exe
1608	MsiExec.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 40887be26764d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Height = "21"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15C7CB51-D05B-11ED-9CB8-C227D5A71BE4} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "387097489"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Height = "0"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 006407f26764d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca00000000020000000000106600000001000020000000c45c411397400d9744cb6d3c31efb87a6eb5d307c536e53ea51c300e620af86c000000000e80000000020000200000005679a939b817e04e8b2994e3b5764c6e577e0b81963e92f2add07724b09f931120000000cd955ce32c564de02c400ef190380ff8eb5db4ac703e9dbc4e6d21703228055840000000de71b66e0d154e13efe43fcdbf43c82071940284362fa2e5064fa889677252a31e2dc74491cea845de7b778bd9feaa99873f6553bf55fbae93f3df7739db3603	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000dbb59ddc676e394a83d3f942d26f43ca00000000020000000000106600000001000020000000766a082683ba4244e6a6649411d43b2e9c537b078fa352e4e819ca6ddc23fb61000000000e80000000020000200000007d693745fe165019bc9713c81e8701bc48e677eb2440cd62025bac6ed4493dc390000000de42c636709d330cee0c7cbd72a4a671049dd2edcb833c073d1d0b20f55e4fcfb3a8a73036692f38f8173bc7245145e69f64e91d9cecbbde6514909792fcbb23175460b57f8ea6af9e19780800b03f061e89e0552a25ec999fa88fffdd6220854d03b1fe819fda237233df38f9c1890a6e8f31286d10c6279fd019cc3f3e726bb3a8f388f45334c175fa0829eb965420400000002e314ea51a4787c19712c3b8ce64eff8b4fe79c72c0c741847af93fd27ea2d3ff1efdac52c61a2c0f8acb70ac5e5e8e5264e922a1ef93f8736e988ea90356dc8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Modifies registry class 48 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlot = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 200000001a00eebbfe230000100090e24d373f126545916439c4925e467b00000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1668	iexplore.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1604	7zG.exe
Token: 35	1604	7zG.exe
Token: SeSecurityPrivilege	1604	7zG.exe
Token: SeSecurityPrivilege	1604	7zG.exe
Token: 33	1232	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1232	AUDIODG.EXE
Token: 33	1232	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1232	AUDIODG.EXE
Token: SeShutdownPrivilege	1040	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1652	msiexec.exe
Token: SeTakeOwnershipPrivilege	1652	msiexec.exe
Token: SeSecurityPrivilege	1652	msiexec.exe
Token: SeCreateTokenPrivilege	1040	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1040	msiexec.exe
Token: SeLockMemoryPrivilege	1040	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1040	msiexec.exe
Token: SeMachineAccountPrivilege	1040	msiexec.exe
Token: SeTcbPrivilege	1040	msiexec.exe
Token: SeSecurityPrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeLoadDriverPrivilege	1040	msiexec.exe
Token: SeSystemProfilePrivilege	1040	msiexec.exe
Token: SeSystemtimePrivilege	1040	msiexec.exe
Token: SeProfSingleProcessPrivilege	1040	msiexec.exe
Token: SeIncBasePriorityPrivilege	1040	msiexec.exe
Token: SeCreatePagefilePrivilege	1040	msiexec.exe
Token: SeCreatePermanentPrivilege	1040	msiexec.exe
Token: SeBackupPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeShutdownPrivilege	1040	msiexec.exe
Token: SeDebugPrivilege	1040	msiexec.exe
Token: SeAuditPrivilege	1040	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1040	msiexec.exe
Token: SeChangeNotifyPrivilege	1040	msiexec.exe
Token: SeRemoteShutdownPrivilege	1040	msiexec.exe
Token: SeUndockPrivilege	1040	msiexec.exe
Token: SeSyncAgentPrivilege	1040	msiexec.exe
Token: SeEnableDelegationPrivilege	1040	msiexec.exe
Token: SeManageVolumePrivilege	1040	msiexec.exe
Token: SeImpersonatePrivilege	1040	msiexec.exe
Token: SeCreateGlobalPrivilege	1040	msiexec.exe
Token: SeCreateTokenPrivilege	1040	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1040	msiexec.exe
Token: SeLockMemoryPrivilege	1040	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1040	msiexec.exe
Token: SeMachineAccountPrivilege	1040	msiexec.exe
Token: SeTcbPrivilege	1040	msiexec.exe
Token: SeSecurityPrivilege	1040	msiexec.exe
Token: SeTakeOwnershipPrivilege	1040	msiexec.exe
Token: SeLoadDriverPrivilege	1040	msiexec.exe
Token: SeSystemProfilePrivilege	1040	msiexec.exe
Token: SeSystemtimePrivilege	1040	msiexec.exe
Token: SeProfSingleProcessPrivilege	1040	msiexec.exe
Token: SeIncBasePriorityPrivilege	1040	msiexec.exe
Token: SeCreatePagefilePrivilege	1040	msiexec.exe
Token: SeCreatePermanentPrivilege	1040	msiexec.exe
Token: SeBackupPrivilege	1040	msiexec.exe
Token: SeRestorePrivilege	1040	msiexec.exe
Token: SeShutdownPrivilege	1040	msiexec.exe
Token: SeDebugPrivilege	1040	msiexec.exe
Token: SeAuditPrivilege	1040	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1040	msiexec.exe
Token: SeChangeNotifyPrivilege	1040	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1668	iexplore.exe
1668	iexplore.exe
1604	7zG.exe
1040	msiexec.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1668	iexplore.exe
1668	iexplore.exe
664	IEXPLORE.EXE
664	IEXPLORE.EXE
664	IEXPLORE.EXE
664	IEXPLORE.EXE
1668	iexplore.exe
664	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 664	1668	iexplore.exe	29
PID 1668 wrote to memory of 664	1668	iexplore.exe	29
PID 1668 wrote to memory of 664	1668	iexplore.exe	29
PID 1668 wrote to memory of 664	1668	iexplore.exe	29
PID 888 wrote to memory of 428	888	jdk-8u191-windows-i586.exe	38
PID 888 wrote to memory of 428	888	jdk-8u191-windows-i586.exe	38
PID 888 wrote to memory of 428	888	jdk-8u191-windows-i586.exe	38
PID 888 wrote to memory of 428	888	jdk-8u191-windows-i586.exe	38
PID 888 wrote to memory of 428	888	jdk-8u191-windows-i586.exe	38
PID 888 wrote to memory of 428	888	jdk-8u191-windows-i586.exe	38
PID 888 wrote to memory of 428	888	jdk-8u191-windows-i586.exe	38
PID 428 wrote to memory of 1040	428	jdk-8u191-windows-i586.exe	39
PID 428 wrote to memory of 1040	428	jdk-8u191-windows-i586.exe	39
PID 428 wrote to memory of 1040	428	jdk-8u191-windows-i586.exe	39
PID 428 wrote to memory of 1040	428	jdk-8u191-windows-i586.exe	39
PID 428 wrote to memory of 1040	428	jdk-8u191-windows-i586.exe	39
PID 428 wrote to memory of 1040	428	jdk-8u191-windows-i586.exe	39
PID 428 wrote to memory of 1040	428	jdk-8u191-windows-i586.exe	39
PID 1652 wrote to memory of 1608	1652	msiexec.exe	41
PID 1652 wrote to memory of 1608	1652	msiexec.exe	41
PID 1652 wrote to memory of 1608	1652	msiexec.exe	41
PID 1652 wrote to memory of 1608	1652	msiexec.exe	41
PID 1652 wrote to memory of 1608	1652	msiexec.exe	41
PID 1652 wrote to memory of 1608	1652	msiexec.exe	41
PID 1652 wrote to memory of 1608	1652	msiexec.exe	41

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://drive.google.com/u/0/uc?id=1gB2CQFeZrXRXInGSOz-zPvyA0NYgIBU1&export=download
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1668 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:664

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\ERROR422 By Arnob Tha Fighter Gamer\" -spe -an -ai#7zMap30227:128:7zEvent5238
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1604

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x57c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1232

C:\Users\Admin\Desktop\ERROR422 By Arnob Tha Fighter Gamer\54 45 53 54\jdk-8u191-windows-i586.exe
"C:\Users\Admin\Desktop\ERROR422 By Arnob Tha Fighter Gamer\54 45 53 54\jdk-8u191-windows-i586.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:888
- C:\Users\Admin\AppData\Local\Temp\jds7171662.tmp\jdk-8u191-windows-i586.exe
  "C:\Users\Admin\AppData\Local\Temp\jds7171662.tmp\jdk-8u191-windows-i586.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\SysWOW64\\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk1.8.0_191\jdk1.8.0_191.msi" WRAPPER=1
    3⤵
    - Blocklisted process makes network request
    - Enumerates connected drives
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:1040

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DCF5FCF438F859E985D95285B72E997D C
  2⤵
  - Loads dropped DLL
  PID:1608

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2040

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ef243b3ab982d4dde3aa53c6cb1f173

SHA1
1d9d7bd9db80991a5e84600e86dabe0d8d61ac39

SHA256
8fb6a2e744e5b0da0cdc3dfdef665bce59b3c69f36279768823115310f764d34

SHA512
d1fccb0be8a907aab54dcc3040d711796778c044370a661905dfe060c243d02601a85a77c671d98c53762e2f955cacb2cffc69f1a9f690cc2e410c6a9e8a7c9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0cd2529d989dae64b3e7c3eefca8f4d

SHA1
171dbe98a36acedf882ac07eded5206a1786bceb

SHA256
42e04ac84551eab62eb9d4d9ed7f826c0695d5ac73ad33a4c7bb2ff00a9e0f34

SHA512
7b2a15e3bf8b7eedebca40146f339d8ec80815c9af309add32910c4fe85aa0a6e83c7122f7e4d0f9873c285aaf6c86e55460511230456286253dfd2d7b56a0f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
783f139865b0b3e0eabfc99385085bf8

SHA1
4b878e60455fbf1ad2a1f3b41d31b78205a76607

SHA256
29c7dfabf8b2338f167854076b6b595c89e35e78cd7f9761d1b56b6addf5499f

SHA512
92617fc5e94e43df51a591fdf9446817fa66938bc715b4fe0127733d18fe3425e13bb777b6a4d52855d1bb922188132d58a6433887f5a8a4945bf5a6a1863610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b85722f7f5857d39dc895d44a2e42226

SHA1
b6965bfd64362cebc80624f3555afd12156b2a3d

SHA256
fabe61d71f4636afc518ad5aef6e3ba65ead7df52aa3b95735ac4ba1e7b40fbe

SHA512
b472db22188e732a959cc6e66415cb5119fc86c397fc66747a53da55f3493a28521b2c55d46174e3f01f1b1fd4d080d476c3bf3b6d63b01b4331a94fcefbce17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbc93c2177ccf384b4ca673d0da9f782

SHA1
25d07296b3ce72fd1230565795d0bbbca42ea429

SHA256
45a83d7e1b8e4efd14cf00f386e426cdf6abab03685ff0d264f9275ee8d7951c

SHA512
fabac9fce36e97c8b52004b59a7c1854295ba62ad9242af19fb92d10a48a839e86a90eceba9a50b3b0374d2f26327c1f791445d1bbc3c690598353c903f12c96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
235ef430e64185a3e5b2c96e76c55496

SHA1
b574dea9e05e27f27793476e1d03e9f9677a1ce2

SHA256
e22b662eded7e2152e469968eacc5373f3ed44008320d33c1288faa778c0c29c

SHA512
5eb4f6a02b181f9d8901e4762a50a28039d1128dc25732e37bd9a9ad35edb5f2db30d63fea688e99743c35000378502e5ae786bec51533f39042977a39acf95b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32e39ad77912216d9baa4d10ad66080e

SHA1
cc7582b3482b2989b95b823dccca52a632bacc8d

SHA256
8687bd48768a2abff73239ff16fccd2fa044447f1fad098622a8ce1f2170a207

SHA512
3ec9f907561d440abb3495dd59e57e03d5dcceec11c9e216f579cd445e4583280da9cf193f8ac802c72e2e0426504fa64a2497fe3b47197dec8fd004114f53a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a515b4307a2d58555c4d06cc54b32d8

SHA1
e9baa823fa37a2ea3f2d291eb039ddbd22035a9a

SHA256
0ef5134a500c48da279fda88b9896ae00e1679047365338dcb2c356c2afcd012

SHA512
f31400a4ec3e189f3c8e9afc08ba6e5074928f356cb10b52aa366d1ddaf20b010d89d5571b2a7c75b98288685e63074b09ca771f21c7f80c8c961c0fabd7ecce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d62a29db4eb82d23c84f89d5c2677b51

SHA1
bee1738189b181fc08c5fc43decb1d46fa9f7e7b

SHA256
a3c50af8d8fda05621cdbfd9997bd358ff48326a79b1c0ecfacf6c411c36dd6b

SHA512
cd4e518c9c1250252de46ab29cf72662f4274dfff78b927416e66a8c9c3aef4f2d2324bf29e87c085826677044d5047e5c8f42ff6cc03b7e6995df9449e922b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1f2860702dd80ff3ec1e9d3260555f3

SHA1
ec26934f3c20837c8b813b7cb968033cd6fe9630

SHA256
cfad9bbe26ac1d871b67199ea6861ecbc09bca736f65143f8cfb20315969df51

SHA512
de0516f4894fc50c805a70ef9140308d835e2694ade9039f657dcd053976ca79f690d23d1f855a0fa20c601b682aa7f99bccc35acaba9909f2ee3b7192e9f457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c5cc2bf5595935707a83a15bcb20855

SHA1
ee27a885172a4bfaff7b926291b8578723496444

SHA256
42901c92e84a589c27603cd83d6c755951c9cc9cab4da6a0fb10f29244fc53d5

SHA512
de7ef3323f0f14bcefc8ae00b3062eeccfcc9b5a6d4b5cdcb04466c077a152d860ae5967cdc431edd65ae61a38fe1e5a11614e296ec98ac1d257c9342d605ebe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ada9038d867fd6e4893d586b002da5e

SHA1
e3faaf6875d24ccaab63d43baba035393e692cff

SHA256
2d5859fc053456726afe870acbcfa017c9475e0a74d5774b7f22a5533e2c6a6d

SHA512
0050c06e122a7891279e4a18cc12c8723fa9eb08860ed90ff0fce9c0bdcf0324c29706b9e84054318817bd9e00237c942e6a1c796a741770cd825d38e02e86a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
b4d1260967d2b6e292eff946748899a4

SHA1
e4bf4308078057790e8cb6a338cc7b51bb7c3ebf

SHA256
3a8e0251530e75863b3c19a760ad94e3ff2ce9f0fa59f447cde80aab6f9a5d8c

SHA512
012320a6cf8507bb3859cef8163a2a13ed671f18598df7289557379cca9ef49b1c0ac5862d870c3d308132bdc1105aed767cf39b2a2dd8435b56e697d223843f

Download Submit
C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk1.8.0_191\jdk1.8.0_191.msi

Filesize
948KB

MD5
84f5b7ada4e0c06a2aae07a8419c9f64

SHA1
ed8e9b61e4967b0608406f1255e3e2dbfee3cf0b

SHA256
530f769f400f371383aa1ffaab30b46791a3bb5ea8e9304e3efe9ef419a7faa0

SHA512
84a341cd6ad2e6b560f40792042e60d4d68cdc5cfefee7a85f28a55077aa872dcaa16e27b4a95bb7fe2516a4fe3b0e714c746b69cb826b5bddef8a659fcde38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\07asiie\imagestore.dat

Filesize
6KB

MD5
9f85f1921dee3ad222f109c9f403f9b8

SHA1
a1b6b7c020188ce027ec24c8d32560ae527c1923

SHA256
54b5414301ff695daf5c41d9ace916c0532576b3d123afc5756cf111e2737da8

SHA512
facf423cf6c8830f3937dc6e793dc6a0b65be1eb8a65225d5204c9048398ff498d8ece1836e60391fa5534913adef24153cb966f010e5a9bb1e75461224122e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\drive_2022q3_32dp[1].png

Filesize
1KB

MD5
c66f20f2e39eb2f6a0a4cdbe0d955e5f

SHA1
575ef086ce461e0ef83662e3acb3c1a789ebb0a8

SHA256
2ab9cd0ffdddf7bf060620ae328fe626bfa2c004739adedb74ec894faf9bee31

SHA512
b9c44a2113fb078d83e968dc0af2e78995bb6dd4ca25abff31e9ab180849c5de3036b69931cca295ac64155d5b168b634e35b7699f3fe65d4a30e9058a2639bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4D68.tmp

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI2093.tmp

Filesize
565KB

MD5
4ca39f5a1af6d35e41170e8c30a8391e

SHA1
0ba37cf6d207c5401fc24687ae35fd6c93f10b79

SHA256
32b059eb787925202eebe00ab45312f8484a9dc09c0b76df6a7b38a161133457

SHA512
a4bcf340581edee8ad0fabaa9ee93be726d199022f8e7fc64aa88fb52cf713cb5be99cf2b8618aad3a7ac3b1715f1629394e8d8caed0ae113fea5b1674d13c3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI24D8.tmp

Filesize
565KB

MD5
4ca39f5a1af6d35e41170e8c30a8391e

SHA1
0ba37cf6d207c5401fc24687ae35fd6c93f10b79

SHA256
32b059eb787925202eebe00ab45312f8484a9dc09c0b76df6a7b38a161133457

SHA512
a4bcf340581edee8ad0fabaa9ee93be726d199022f8e7fc64aa88fb52cf713cb5be99cf2b8618aad3a7ac3b1715f1629394e8d8caed0ae113fea5b1674d13c3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3981.tmp

Filesize
565KB

MD5
4ca39f5a1af6d35e41170e8c30a8391e

SHA1
0ba37cf6d207c5401fc24687ae35fd6c93f10b79

SHA256
32b059eb787925202eebe00ab45312f8484a9dc09c0b76df6a7b38a161133457

SHA512
a4bcf340581edee8ad0fabaa9ee93be726d199022f8e7fc64aa88fb52cf713cb5be99cf2b8618aad3a7ac3b1715f1629394e8d8caed0ae113fea5b1674d13c3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3981.tmp

Filesize
565KB

MD5
4ca39f5a1af6d35e41170e8c30a8391e

SHA1
0ba37cf6d207c5401fc24687ae35fd6c93f10b79

SHA256
32b059eb787925202eebe00ab45312f8484a9dc09c0b76df6a7b38a161133457

SHA512
a4bcf340581edee8ad0fabaa9ee93be726d199022f8e7fc64aa88fb52cf713cb5be99cf2b8618aad3a7ac3b1715f1629394e8d8caed0ae113fea5b1674d13c3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4D69.tmp

Filesize
161KB

MD5
73b4b714b42fc9a6aaefd0ae59adb009

SHA1
efdaffd5b0ad21913d22001d91bf6c19ecb4ac41

SHA256
c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd

SHA512
73af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4FC2.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\jds7171662.tmp\jdk-8u191-windows-i586.exe

Filesize
197.1MB

MD5
06a347e5483cf47f3c0bc3976a115eb0

SHA1
f882583e7917c6f125dc044cff533e27ff89d246

SHA256
114d2ee05544387200bd22467dac853b03ea3415d4c5c8f36660079f3f676054

SHA512
e0de7d9200f337cc165f317cd86a35f16e592f197871c0acb42a398a0066cf490fb46e904886c37c01ca6f39ff09a5c09b9209adc08a7131070e71123420fe1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
8KB

MD5
12bf9ba07c065dcee937e73350fedd35

SHA1
909cd3c754ddc0ecb2a707d3a8783ce7cf9b94c4

SHA256
7fe75084990fc3ef39b5681efb58da8ce9ae3dad2b18300fa686f7e3c8c6897e

SHA512
3f185ad718bfb35c37be6ca61fe3fc02b61c7c32cb34fcdae0fdb6831eebb95b30053438a550b3e46510cfe0effe90f6751552a3059186859d52bb8a13986e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
8KB

MD5
12bf9ba07c065dcee937e73350fedd35

SHA1
909cd3c754ddc0ecb2a707d3a8783ce7cf9b94c4

SHA256
7fe75084990fc3ef39b5681efb58da8ce9ae3dad2b18300fa686f7e3c8c6897e

SHA512
3f185ad718bfb35c37be6ca61fe3fc02b61c7c32cb34fcdae0fdb6831eebb95b30053438a550b3e46510cfe0effe90f6751552a3059186859d52bb8a13986e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log

Filesize
10KB

MD5
11bdab6f0cf45313f197d95bacd3bab2

SHA1
caffb2b88714c154b2bde9e316ef12d2d202654b

SHA256
7fed5ab4ca10e09034399c4f400e2c2cb64eba1bd6fb9e44af4714c9dd45223c

SHA512
5af551feb37df853861dc68a90f0b7fffabd759299ba51f629f4ee613eaf35e5f4d7449cd6cf8102a2dd46e2389e3e5c66641887f77ed435c6ad23a030da0bd4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YWGHBWHV.txt

Filesize
606B

MD5
dec434e8f77e19ed4f45291a0a781419

SHA1
012db5e9f9931e6f1eab2d9c88a6c55e00e7a94d

SHA256
69cabe75c139a173406d2c0ca10f72769cc0b869bf773a5bb2241b1f1e940e85

SHA512
d3066dd7ee9bf7e5e8aba87fbca3ae8e1bd52c915b99756c21e87d909484617efe225b5dbdf7063c34f493349363b33b037a348e29dd8a8da97c38dbcdb217f0

Download Submit
C:\Users\Admin\Desktop\ERROR422 By Arnob Tha Fighter Gamer.zip.eth1hlh.partial

Filesize
203.3MB

MD5
90314c49fa20e9f74d6d749565dae98a

SHA1
05ea9fcd8cefe8e4253f226b298ace6e3494fc0c

SHA256
6a7957b6b65c5f2117aedd42accf385358f3ad7be17040c13f0f43b3adedc96c

SHA512
94e5f6dfedef1a267e310da2c9b0a602a64efa66b88a0f8fbf11ab94c3fa1816e6c5bc9ac82f0d2fa5776d835c2f805c110e4cc37bc035384ba405528d22a843

Download Submit
C:\Users\Admin\Desktop\ERROR422 By Arnob Tha Fighter Gamer\54 45 53 54\jdk-8u191-windows-i586.exe

Filesize
197.3MB

MD5
50cfd28a3a3243bc5e9be096a3b9fd97

SHA1
bc8f26edb5d1b6d93459405da76bc52c9b882e69

SHA256
a92fce986622e9846b93e396a7eda6214e7f7ea90860794c934f423c10813622

SHA512
859e7cc427a5ea990dd3b5301d0bb68aceac9b32f62363d5d21ed90ad45a7a7912d201dc276786bfcfb18a8683776623c7b78c4ad06c4f8002033bfaa6e8855e

Download Submit
\Users\Admin\AppData\Local\Temp\MSI2093.tmp

Filesize
565KB

MD5
4ca39f5a1af6d35e41170e8c30a8391e

SHA1
0ba37cf6d207c5401fc24687ae35fd6c93f10b79

SHA256
32b059eb787925202eebe00ab45312f8484a9dc09c0b76df6a7b38a161133457

SHA512
a4bcf340581edee8ad0fabaa9ee93be726d199022f8e7fc64aa88fb52cf713cb5be99cf2b8618aad3a7ac3b1715f1629394e8d8caed0ae113fea5b1674d13c3a

Download Submit
\Users\Admin\AppData\Local\Temp\MSI24D8.tmp

Filesize
565KB

MD5
4ca39f5a1af6d35e41170e8c30a8391e

SHA1
0ba37cf6d207c5401fc24687ae35fd6c93f10b79

SHA256
32b059eb787925202eebe00ab45312f8484a9dc09c0b76df6a7b38a161133457

SHA512
a4bcf340581edee8ad0fabaa9ee93be726d199022f8e7fc64aa88fb52cf713cb5be99cf2b8618aad3a7ac3b1715f1629394e8d8caed0ae113fea5b1674d13c3a

Download Submit
\Users\Admin\AppData\Local\Temp\MSI3981.tmp

Filesize
565KB

MD5
4ca39f5a1af6d35e41170e8c30a8391e

SHA1
0ba37cf6d207c5401fc24687ae35fd6c93f10b79

SHA256
32b059eb787925202eebe00ab45312f8484a9dc09c0b76df6a7b38a161133457

SHA512
a4bcf340581edee8ad0fabaa9ee93be726d199022f8e7fc64aa88fb52cf713cb5be99cf2b8618aad3a7ac3b1715f1629394e8d8caed0ae113fea5b1674d13c3a

Download Submit
\Users\Admin\AppData\Local\Temp\jds7171662.tmp\jdk-8u191-windows-i586.exe

Filesize
197.1MB

MD5
06a347e5483cf47f3c0bc3976a115eb0

SHA1
f882583e7917c6f125dc044cff533e27ff89d246

SHA256
114d2ee05544387200bd22467dac853b03ea3415d4c5c8f36660079f3f676054

SHA512
e0de7d9200f337cc165f317cd86a35f16e592f197871c0acb42a398a0066cf490fb46e904886c37c01ca6f39ff09a5c09b9209adc08a7131070e71123420fe1d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads