lgoogloader | 8e9c6b72a19705e65d654814d0770a67c7c4a2e52915f6115dc740ab254ed4a9

Resubmissions

20-05-2023 01:01

230520-bdhlhahd64 10

20-05-2023 00:59

17-05-2023 15:12

16-05-2023 18:13

16-05-2023 18:11

16-05-2023 18:10

16-05-2023 18:03

Analysis

max time kernel
91s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2023 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a.exe
Size

5KB
MD5

69525fa93fd47eb3c533afe3b1baba48
SHA1

3dea1b337987177c73c64e89b370d90dc94c64cb
SHA256

8e9c6b72a19705e65d654814d0770a67c7c4a2e52915f6115dc740ab254ed4a9
SHA512

909202467de5c96404c154cd3be55643df62c13c395bd6e0406be5834c3a10b953f42cc3520ac5979af754af192260ec737d19892333e5a8dfab79aef9b23182
SSDEEP

48:6di2oYDjX9iqhf3FXfkQHjJhyPFlWa8tYDdqIYM/cphuOulavTqXSfbNtm:uNiqp3JkQHyDUtE2WcpisvNzNt

Score

10^/10

lgoogloader redline downloader evasion infostealer persistence

Malware Config

Signatures

Detects LgoogLoader payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1560-255-0x0000000001860000-0x000000000186D000-memory.dmp	family_lgoogloader

LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

AppLaunch.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\""	AppLaunch.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4432-233-0x0000000000610000-0x0000000000638000-memory.dmp	family_redline

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

Processes:

version32.exe

description pid process target process

PID 804 created 2600 804 version32.exe Explorer.EXE
PID 804 created 2600 804 version32.exe Explorer.EXE
Downloads MZ/PE file

description	pid	process	target process
PID 804 created 2600	804	version32.exe	Explorer.EXE
PID 804 created 2600	804	version32.exe	Explorer.EXE

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

new123.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	new123.exe

Stops running service(s) 3 TTPs
evasion

Modify Existing Service
T1031

Impair Defenses
T1562

Service Stop
T1489
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

a.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation a.exe
Executes dropped EXE 4 IoCs

Processes:

version32.exeMavrodiBlack.exenew123.exerun.exe

pid process

804 version32.exe
2924 MavrodiBlack.exe
3808 new123.exe
4180 run.exe
Loads dropped DLL 1 IoCs

Processes:

taskmgr.exe

pid process

540 taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	a.exe

pid	process
804	version32.exe
2924	MavrodiBlack.exe
3808	new123.exe
4180	run.exe

Adds Run key to start application 2 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

AppLaunch.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_5 = "_default64.exe"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_7 = "ux-cryptor.exe"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_8 = "crypt0rsx.exe"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\OneDrive10293 = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" /setup"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\WINDOWS = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" --wininit"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_1 = "AWindowsService.exe"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_2 = "taskhost.exe"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_4 = "System.exe"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_6 = "native.exe"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsInstaller = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" -startup"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSEdgeUpdateX = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\""	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\System3264Wow = "\"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe\" --init"	AppLaunch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WIN32_3 = "windowsx-c.exe"	AppLaunch.exe

Drops desktop.ini file(s) 5 IoCs

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeLogonUI.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	attrib.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	attrib.exe
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	LogonUI.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of SetThreadContext 4 IoCs

Processes:

MavrodiBlack.exeAppLaunch.exerun.exenew123.exe

description	pid	process	target process
PID 2924 set thread context of 2108	2924	MavrodiBlack.exe	AppLaunch.exe
PID 2108 set thread context of 1628	2108	AppLaunch.exe	AppLaunch.exe
PID 4180 set thread context of 4432	4180	run.exe	AppLaunch.exe
PID 3808 set thread context of 1560	3808	new123.exe	AddInProcess32.exe

Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exesc.exe

pid process

3292 sc.exe
1328 sc.exe
2184 sc.exe
4756 sc.exe
4524 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3292	sc.exe
1328	sc.exe
2184	sc.exe
4756	sc.exe
4524	sc.exe

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2368	2924	WerFault.exe	MavrodiBlack.exe
4116	2108	WerFault.exe	AppLaunch.exe
3956	4180	WerFault.exe	run.exe
4132	2108	WerFault.exe	AppLaunch.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2292 taskkill.exe

pid	process
2292	taskkill.exe

Modifies data under HKEY_USERS 52 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{af0fc727-0000-0000-0000-d01200000000}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{af0fc727-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001bc024d93288d901	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\TIP	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language\00000000 = "00000409"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "173"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\CachedLanguageName = "@Winlangdb.dll,-1121"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\Language	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload\1 = "00000409"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowCasing = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\ShowShiftLock = "1"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\CLSID = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US\0409:00000409 = "1"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\ASSEMBLYITEM\0X00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Substitutes	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\HiddenDummyLayouts	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "5"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{af0fc727-0000-0000-0000-d01200000000}\MaxCapacity = "15140"	LogonUI.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\CTF\SORTORDER\LANGUAGE	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe

Modifies registry class 1 IoCs

Processes:

taskmgr.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings taskmgr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskmgr.exeversion32.exepowershell.exenew123.exeAppLaunch.exe

pid	process
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
804	version32.exe
804	version32.exe
540	taskmgr.exe
4800	powershell.exe
4800	powershell.exe
4800	powershell.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
3808	new123.exe
3808	new123.exe
3808	new123.exe
3808	new123.exe
3808	new123.exe
3808	new123.exe
3808	new123.exe
3808	new123.exe
3808	new123.exe
3808	new123.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
804	version32.exe
804	version32.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
1628	AppLaunch.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

new123.exe

pid process

3808 new123.exe

pid	process
3808	new123.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

Processes:

a.exetaskmgr.exea.exepowershell.exenew123.exeAppLaunch.exetaskkill.exeLogonUI.exe

description	pid	process
Token: SeDebugPrivilege	2468	a.exe
Token: SeDebugPrivilege	540	taskmgr.exe
Token: SeSystemProfilePrivilege	540	taskmgr.exe
Token: SeCreateGlobalPrivilege	540	taskmgr.exe
Token: SeDebugPrivilege	1404	a.exe
Token: SeDebugPrivilege	4800	powershell.exe
Token: SeDebugPrivilege	3808	new123.exe
Token: SeLoadDriverPrivilege	3808	new123.exe
Token: SeDebugPrivilege	3808	new123.exe
Token: SeDebugPrivilege	1628	AppLaunch.exe
Token: SeDebugPrivilege	2292	taskkill.exe
Token: SeShutdownPrivilege	4796	LogonUI.exe
Token: SeCreatePagefilePrivilege	4796	LogonUI.exe

Suspicious use of FindShellTrayWindow 58 IoCs

Processes:

taskmgr.exe

pid	process
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe

Suspicious use of SendNotifyMessage 55 IoCs

Processes:

taskmgr.exe

pid	process
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe
540	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

4796 LogonUI.exe

pid	process
4796	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a.exeMavrodiBlack.exeAppLaunch.exerun.exenew123.execmd.exeAppLaunch.exe

description	pid	process	target process
PID 1404 wrote to memory of 804	1404	a.exe	version32.exe
PID 1404 wrote to memory of 804	1404	a.exe	version32.exe
PID 1404 wrote to memory of 2924	1404	a.exe	MavrodiBlack.exe
PID 1404 wrote to memory of 2924	1404	a.exe	MavrodiBlack.exe
PID 1404 wrote to memory of 2924	1404	a.exe	MavrodiBlack.exe
PID 1404 wrote to memory of 3808	1404	a.exe	new123.exe
PID 1404 wrote to memory of 3808	1404	a.exe	new123.exe
PID 2924 wrote to memory of 2108	2924	MavrodiBlack.exe	AppLaunch.exe
PID 2924 wrote to memory of 2108	2924	MavrodiBlack.exe	AppLaunch.exe
PID 2924 wrote to memory of 2108	2924	MavrodiBlack.exe	AppLaunch.exe
PID 2924 wrote to memory of 2108	2924	MavrodiBlack.exe	AppLaunch.exe
PID 2924 wrote to memory of 2108	2924	MavrodiBlack.exe	AppLaunch.exe
PID 1404 wrote to memory of 4180	1404	a.exe	run.exe
PID 1404 wrote to memory of 4180	1404	a.exe	run.exe
PID 1404 wrote to memory of 4180	1404	a.exe	run.exe
PID 2108 wrote to memory of 1628	2108	AppLaunch.exe	AppLaunch.exe
PID 2108 wrote to memory of 1628	2108	AppLaunch.exe	AppLaunch.exe
PID 2108 wrote to memory of 1628	2108	AppLaunch.exe	AppLaunch.exe
PID 2108 wrote to memory of 1628	2108	AppLaunch.exe	AppLaunch.exe
PID 2108 wrote to memory of 1628	2108	AppLaunch.exe	AppLaunch.exe
PID 4180 wrote to memory of 4432	4180	run.exe	AppLaunch.exe
PID 4180 wrote to memory of 4432	4180	run.exe	AppLaunch.exe
PID 4180 wrote to memory of 4432	4180	run.exe	AppLaunch.exe
PID 4180 wrote to memory of 4432	4180	run.exe	AppLaunch.exe
PID 4180 wrote to memory of 4432	4180	run.exe	AppLaunch.exe
PID 3808 wrote to memory of 2972	3808	new123.exe	aspnet_regsql.exe
PID 3808 wrote to memory of 2972	3808	new123.exe	aspnet_regsql.exe
PID 3808 wrote to memory of 3772	3808	new123.exe	aspnet_regiis.exe
PID 3808 wrote to memory of 3772	3808	new123.exe	aspnet_regiis.exe
PID 3808 wrote to memory of 1864	3808	new123.exe	Microsoft.Workflow.Compiler.exe
PID 3808 wrote to memory of 1864	3808	new123.exe	Microsoft.Workflow.Compiler.exe
PID 3808 wrote to memory of 732	3808	new123.exe	csc.exe
PID 3808 wrote to memory of 732	3808	new123.exe	csc.exe
PID 3808 wrote to memory of 3420	3808	new123.exe	EdmGen.exe
PID 3808 wrote to memory of 3420	3808	new123.exe	EdmGen.exe
PID 3808 wrote to memory of 1560	3808	new123.exe	AddInProcess32.exe
PID 3808 wrote to memory of 1560	3808	new123.exe	AddInProcess32.exe
PID 3808 wrote to memory of 1560	3808	new123.exe	AddInProcess32.exe
PID 3808 wrote to memory of 1560	3808	new123.exe	AddInProcess32.exe
PID 3808 wrote to memory of 1560	3808	new123.exe	AddInProcess32.exe
PID 3808 wrote to memory of 1560	3808	new123.exe	AddInProcess32.exe
PID 3808 wrote to memory of 1560	3808	new123.exe	AddInProcess32.exe
PID 3808 wrote to memory of 1560	3808	new123.exe	AddInProcess32.exe
PID 3808 wrote to memory of 1560	3808	new123.exe	AddInProcess32.exe
PID 3808 wrote to memory of 1560	3808	new123.exe	AddInProcess32.exe
PID 4864 wrote to memory of 4756	4864	cmd.exe	sc.exe
PID 4864 wrote to memory of 4756	4864	cmd.exe	sc.exe
PID 4864 wrote to memory of 4524	4864	cmd.exe	sc.exe
PID 4864 wrote to memory of 4524	4864	cmd.exe	sc.exe
PID 4864 wrote to memory of 3292	4864	cmd.exe	sc.exe
PID 4864 wrote to memory of 3292	4864	cmd.exe	sc.exe
PID 4864 wrote to memory of 2184	4864	cmd.exe	sc.exe
PID 4864 wrote to memory of 2184	4864	cmd.exe	sc.exe
PID 4864 wrote to memory of 1328	4864	cmd.exe	sc.exe
PID 4864 wrote to memory of 1328	4864	cmd.exe	sc.exe
PID 1628 wrote to memory of 340	1628	AppLaunch.exe	cmd.exe
PID 1628 wrote to memory of 340	1628	AppLaunch.exe	cmd.exe
PID 1628 wrote to memory of 340	1628	AppLaunch.exe	cmd.exe
PID 1628 wrote to memory of 1868	1628	AppLaunch.exe	cmd.exe
PID 1628 wrote to memory of 1868	1628	AppLaunch.exe	cmd.exe
PID 1628 wrote to memory of 1868	1628	AppLaunch.exe	cmd.exe
PID 1628 wrote to memory of 3016	1628	AppLaunch.exe	cmd.exe
PID 1628 wrote to memory of 3016	1628	AppLaunch.exe	cmd.exe
PID 1628 wrote to memory of 3016	1628	AppLaunch.exe	cmd.exe

Views/modifies file attributes 1 TTPs 10 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exe

pid process

64 attrib.exe
4532 attrib.exe
4404 attrib.exe
2168 attrib.exe
740 attrib.exe
4448 attrib.exe
2800 attrib.exe
2468 attrib.exe
5056 attrib.exe
4068 attrib.exe

pid	process
64	attrib.exe
4532	attrib.exe
4404	attrib.exe
2168	attrib.exe
740	attrib.exe
4448	attrib.exe
2800	attrib.exe
2468	attrib.exe
5056	attrib.exe
4068	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2600

C:\Users\Admin\AppData\Local\Temp\a.exe
"C:\Users\Admin\AppData\Local\Temp\a.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:540

C:\Users\Admin\AppData\Local\Temp\a.exe
"C:\Users\Admin\AppData\Local\Temp\a.exe"
2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1404

C:\Users\Admin\AppData\Local\Temp\a\version32.exe
"C:\Users\Admin\AppData\Local\Temp\a\version32.exe"
3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:804

C:\Users\Admin\AppData\Local\Temp\a\MavrodiBlack.exe
"C:\Users\Admin\AppData\Local\Temp\a\MavrodiBlack.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
4⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
5⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Telegram for contact: @yes_u_are_hacked 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
6⤵
PID:340

C:\Windows\SysWOW64\attrib.exe
attrib +h +s +r +i /D
7⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:4404

C:\Windows\SysWOW64\attrib.exe
attrib -h +s +r info-0v92.txt
7⤵
- Views/modifies file attributes
PID:2800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Telegram for contact: @yes_u_are_hacked 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
6⤵
PID:1868

C:\Windows\SysWOW64\attrib.exe
attrib +h +s +r +i /D
7⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:2168

C:\Windows\SysWOW64\attrib.exe
attrib -h +s +r info-0v92.txt
7⤵
- Views/modifies file attributes
PID:740

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Telegram for contact: @yes_u_are_hacked 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
6⤵
PID:3016

C:\Windows\SysWOW64\attrib.exe
attrib +h +s +r +i /D
7⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:2468

C:\Windows\SysWOW64\attrib.exe
attrib -h +s +r info-0v92.txt
7⤵
- Views/modifies file attributes
PID:64

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Telegram for contact: @yes_u_are_hacked 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
6⤵
PID:3996

C:\Windows\SysWOW64\attrib.exe
attrib +h +s +r +i /D
7⤵
- Drops desktop.ini file(s)
- Views/modifies file attributes
PID:5056

C:\Windows\SysWOW64\attrib.exe
attrib -h +s +r info-0v92.txt
7⤵
- Views/modifies file attributes
PID:4532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] Ooops! Your files are encrypted by the CryptoBytes hacker group! Telegram for contact: @yes_u_are_hacked 1>info-0v92.txt & attrib -h +s +r info-0v92.txt
6⤵
PID:4352

C:\Windows\SysWOW64\attrib.exe
attrib +h +s +r +i /D
7⤵
- Views/modifies file attributes
PID:4448

C:\Windows\SysWOW64\attrib.exe
attrib -h +s +r info-0v92.txt
7⤵
- Views/modifies file attributes
PID:4068

C:\Windows\SysWOW64\taskkill.exe
taskkill.exe /im Explorer.exe /f
6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 460
5⤵
- Program crash
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2108 -s 488
5⤵
- Program crash
PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 488
4⤵
- Program crash
PID:2368

C:\Users\Admin\AppData\Local\Temp\a\new123.exe
"C:\Users\Admin\AppData\Local\Temp\a\new123.exe"
3⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3808

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
4⤵
PID:3772

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
4⤵
PID:2972

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
4⤵
PID:732

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
4⤵
PID:1864

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
4⤵
PID:3420

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
4⤵
PID:1560

C:\Users\Admin\AppData\Local\Temp\a\run.exe
"C:\Users\Admin\AppData\Local\Temp\a\run.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4180

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"
4⤵
PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4180 -s 500
4⤵
- Program crash
PID:3956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800

C:\Windows\System32\cmd.exe
C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
2⤵
- Suspicious use of WriteProcessMemory
PID:4864

C:\Windows\System32\sc.exe
sc stop UsoSvc
3⤵
- Launches sc.exe
PID:4756

C:\Windows\System32\sc.exe
sc stop WaaSMedicSvc
3⤵
- Launches sc.exe
PID:4524

C:\Windows\System32\sc.exe
sc stop wuauserv
3⤵
- Launches sc.exe
PID:3292

C:\Windows\System32\sc.exe
sc stop dosvc
3⤵
- Launches sc.exe
PID:1328

C:\Windows\System32\sc.exe
sc stop bits
3⤵
- Launches sc.exe
PID:2184

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2924 -ip 2924
1⤵
PID:4444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2108 -ip 2108
1⤵
PID:3364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4180 -ip 4180
1⤵
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2108 -ip 2108
1⤵
PID:3900

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3968055 /state1:0x41c64e6d
1⤵
- Drops desktop.ini file(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

T1004

Registry Run Keys / Startup Folder

T1060

Modify Existing Service

T1031

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Impair Defenses

T1562

Hidden Files and Directories

T1158

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-1013461898-3711306144-4198452673-1000\ReadOnly\LockScreen_O\LockScreen___1280_0720_notdimmed.jpg
Filesize
303KB

MD5
d1f63d4715c318e4e4f975055d78c220

SHA1
2629da1b254afb760fbade9b4ce94f1979b72076

SHA256
cbd60cf9aa0cab50c7aa8830b7ae401f1e27e02962a8546fe8ba59c20d0e90c4

SHA512
d874b028d18ebe3b3f87786bb96343e40c7393d7b4e1be345f2a8b28bf85cd47c2bc9c83fdea8f813e2a75e2718a563e763e0d16839335b3e4ca961912e16203

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\a.exe.log
Filesize
847B

MD5
66a0a4aa01208ed3d53a5e131a8d030a

SHA1
ef5312ba2b46b51a4d04b574ca1789ac4ff4a6b1

SHA256
f0ab05c32d6af3c2b559dbce4dec025ce3e730655a2430ade520e89a557cace8

SHA512
626f0dcf0c6bcdc0fef25dc7da058003cf929fd9a39a9f447b79fb139a417532a46f8bca1ff2dbde09abfcd70f5fb4f8d059b1fe91977c377df2f5f751c84c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2lqvnkb1.25y.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\MavrodiBlack.exe
Filesize
327KB

MD5
22b25918bfdd12b1b6646cf6cdf1e867

SHA1
3b621a13ff4b1493df48992d37fcc9d67edf40ab

SHA256
8be6deb199d15344938cca068b14d9af482d69b0e864c42bc0f11690dd8cf1f7

SHA512
32fbbb221a7aa0977d07c4ad67c3564f133cdade6db8488e67345ecf5c8d594123da1ddb506166f1e25ce6174a004f3f5d428dfea44eda4b7ce4a24cd33721e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\MavrodiBlack.exe
Filesize
327KB

MD5
22b25918bfdd12b1b6646cf6cdf1e867

SHA1
3b621a13ff4b1493df48992d37fcc9d67edf40ab

SHA256
8be6deb199d15344938cca068b14d9af482d69b0e864c42bc0f11690dd8cf1f7

SHA512
32fbbb221a7aa0977d07c4ad67c3564f133cdade6db8488e67345ecf5c8d594123da1ddb506166f1e25ce6174a004f3f5d428dfea44eda4b7ce4a24cd33721e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\new123.exe
Filesize
566KB

MD5
c56622a2e329adf8167d71814e8c92a4

SHA1
e02cf71f24e10383b526181f86591a041b1adeb6

SHA256
57a58ba29a3ed07f244f57276d1d265c9ab1aee6d9ac6f1d84b24c6561fef589

SHA512
70dc0ffba336ef2e77e1bbdcd278577b40e8f0d4aacac905dbd670c5dfa67e04f7707345bbecb2fedf103be9315302e09864175f4a361b95ee5ca9ce8edf0b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\new123.exe
Filesize
566KB

MD5
c56622a2e329adf8167d71814e8c92a4

SHA1
e02cf71f24e10383b526181f86591a041b1adeb6

SHA256
57a58ba29a3ed07f244f57276d1d265c9ab1aee6d9ac6f1d84b24c6561fef589

SHA512
70dc0ffba336ef2e77e1bbdcd278577b40e8f0d4aacac905dbd670c5dfa67e04f7707345bbecb2fedf103be9315302e09864175f4a361b95ee5ca9ce8edf0b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\new123.exe
Filesize
566KB

MD5
c56622a2e329adf8167d71814e8c92a4

SHA1
e02cf71f24e10383b526181f86591a041b1adeb6

SHA256
57a58ba29a3ed07f244f57276d1d265c9ab1aee6d9ac6f1d84b24c6561fef589

SHA512
70dc0ffba336ef2e77e1bbdcd278577b40e8f0d4aacac905dbd670c5dfa67e04f7707345bbecb2fedf103be9315302e09864175f4a361b95ee5ca9ce8edf0b24

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\run.exe
Filesize
316KB

MD5
c121fb3f802d3c2c2774d279a5b658d3

SHA1
b809947028672f7840ab7eca77aeb7a29dddbc1b

SHA256
b071131b4822c690af1cfe537a14e2bd0c6cbeb71d9088615f1b8bd4179efc62

SHA512
2ac764237f3427bd3ecaa6af29ed544330c89266bac1aca766c0685219e4ae53638d72b293ac6d956af6299148cb8d7ed2aebdfe89b5c15593792efe8dc00141

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\run.exe
Filesize
316KB

MD5
c121fb3f802d3c2c2774d279a5b658d3

SHA1
b809947028672f7840ab7eca77aeb7a29dddbc1b

SHA256
b071131b4822c690af1cfe537a14e2bd0c6cbeb71d9088615f1b8bd4179efc62

SHA512
2ac764237f3427bd3ecaa6af29ed544330c89266bac1aca766c0685219e4ae53638d72b293ac6d956af6299148cb8d7ed2aebdfe89b5c15593792efe8dc00141

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\version32.exe
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\version32.exe
Filesize
9.9MB

MD5
9889b03f358c1e2a2635ae17eb4bf489

SHA1
3919276a8b72c4205512dd41ecf8c066bf721be0

SHA256
0c879e57aab759d1e31ba1ac2a03ffe1be3f44bd028a2dd4c597acec333b83d6

SHA512
ef9522066e646523c53249f788efdef9ac441087d8f6b6a5a56a2811f71cbf3b344be0f118bc9f3c12f62767d427736e5cab200c55ed66521170b3fc0ce31d6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\version32.exe
Filesize
9.9MB

MD5
9889b03f358c1e2a2635ae17eb4bf489

SHA1
3919276a8b72c4205512dd41ecf8c066bf721be0

SHA256
0c879e57aab759d1e31ba1ac2a03ffe1be3f44bd028a2dd4c597acec333b83d6

SHA512
ef9522066e646523c53249f788efdef9ac441087d8f6b6a5a56a2811f71cbf3b344be0f118bc9f3c12f62767d427736e5cab200c55ed66521170b3fc0ce31d6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\a\version32.exe
Filesize
9.9MB

MD5
9889b03f358c1e2a2635ae17eb4bf489

SHA1
3919276a8b72c4205512dd41ecf8c066bf721be0

SHA256
0c879e57aab759d1e31ba1ac2a03ffe1be3f44bd028a2dd4c597acec333b83d6

SHA512
ef9522066e646523c53249f788efdef9ac441087d8f6b6a5a56a2811f71cbf3b344be0f118bc9f3c12f62767d427736e5cab200c55ed66521170b3fc0ce31d6a

Download Submit
C:\Users\Admin\Desktop\info-0v92.txt
Filesize
115B

MD5
3a135cc92765c4a3a965fa3a7db2ea67

SHA1
afbc41262f5587871844d109930e2f1873e57b7f

SHA256
a6be5880116734b1d83397f4c3bf108d91a3353eecc67258a87bcbf4959b64b7

SHA512
a806e23e7846a1ac2e32dda8e064ee94aadcf7203f5f5068d08c9ad1693c49af7b3f59c5c7baf03b346f8b85d5e5b205163670a0dd7009f1f1814de11ca76850

Download Submit
C:\Users\Admin\Documents\info-0v92.txt
Filesize
115B

MD5
3a135cc92765c4a3a965fa3a7db2ea67

SHA1
afbc41262f5587871844d109930e2f1873e57b7f

SHA256
a6be5880116734b1d83397f4c3bf108d91a3353eecc67258a87bcbf4959b64b7

SHA512
a806e23e7846a1ac2e32dda8e064ee94aadcf7203f5f5068d08c9ad1693c49af7b3f59c5c7baf03b346f8b85d5e5b205163670a0dd7009f1f1814de11ca76850

Download Submit
C:\Users\Admin\Documents\info-0v92.txt
Filesize
115B

MD5
3a135cc92765c4a3a965fa3a7db2ea67

SHA1
afbc41262f5587871844d109930e2f1873e57b7f

SHA256
a6be5880116734b1d83397f4c3bf108d91a3353eecc67258a87bcbf4959b64b7

SHA512
a806e23e7846a1ac2e32dda8e064ee94aadcf7203f5f5068d08c9ad1693c49af7b3f59c5c7baf03b346f8b85d5e5b205163670a0dd7009f1f1814de11ca76850

Download Submit
C:\Users\Admin\Downloads\info-0v92.txt
Filesize
115B

MD5
3a135cc92765c4a3a965fa3a7db2ea67

SHA1
afbc41262f5587871844d109930e2f1873e57b7f

SHA256
a6be5880116734b1d83397f4c3bf108d91a3353eecc67258a87bcbf4959b64b7

SHA512
a806e23e7846a1ac2e32dda8e064ee94aadcf7203f5f5068d08c9ad1693c49af7b3f59c5c7baf03b346f8b85d5e5b205163670a0dd7009f1f1814de11ca76850

Download Submit
C:\Users\Admin\info-0v92.txt
Filesize
115B

MD5
3a135cc92765c4a3a965fa3a7db2ea67

SHA1
afbc41262f5587871844d109930e2f1873e57b7f

SHA256
a6be5880116734b1d83397f4c3bf108d91a3353eecc67258a87bcbf4959b64b7

SHA512
a806e23e7846a1ac2e32dda8e064ee94aadcf7203f5f5068d08c9ad1693c49af7b3f59c5c7baf03b346f8b85d5e5b205163670a0dd7009f1f1814de11ca76850

Download Submit
C:\Users\Public\Desktop\info-0v92.txt
Filesize
115B

MD5
3a135cc92765c4a3a965fa3a7db2ea67

SHA1
afbc41262f5587871844d109930e2f1873e57b7f

SHA256
a6be5880116734b1d83397f4c3bf108d91a3353eecc67258a87bcbf4959b64b7

SHA512
a806e23e7846a1ac2e32dda8e064ee94aadcf7203f5f5068d08c9ad1693c49af7b3f59c5c7baf03b346f8b85d5e5b205163670a0dd7009f1f1814de11ca76850

Download Submit
\??\c:\users\admin\appdata\local\temp\a\mavrodiblack.exe
Filesize
327KB

MD5
22b25918bfdd12b1b6646cf6cdf1e867

SHA1
3b621a13ff4b1493df48992d37fcc9d67edf40ab

SHA256
8be6deb199d15344938cca068b14d9af482d69b0e864c42bc0f11690dd8cf1f7

SHA512
32fbbb221a7aa0977d07c4ad67c3564f133cdade6db8488e67345ecf5c8d594123da1ddb506166f1e25ce6174a004f3f5d428dfea44eda4b7ce4a24cd33721e2

Download Submit
\??\c:\users\admin\appdata\local\temp\a\run.exe
Filesize
316KB

MD5
c121fb3f802d3c2c2774d279a5b658d3

SHA1
b809947028672f7840ab7eca77aeb7a29dddbc1b

SHA256
b071131b4822c690af1cfe537a14e2bd0c6cbeb71d9088615f1b8bd4179efc62

SHA512
2ac764237f3427bd3ecaa6af29ed544330c89266bac1aca766c0685219e4ae53638d72b293ac6d956af6299148cb8d7ed2aebdfe89b5c15593792efe8dc00141

Download Submit
\??\c:\users\admin\appdata\local\temp\a\version32.exe
Filesize
9.9MB

MD5
9889b03f358c1e2a2635ae17eb4bf489

SHA1
3919276a8b72c4205512dd41ecf8c066bf721be0

SHA256
0c879e57aab759d1e31ba1ac2a03ffe1be3f44bd028a2dd4c597acec333b83d6

SHA512
ef9522066e646523c53249f788efdef9ac441087d8f6b6a5a56a2811f71cbf3b344be0f118bc9f3c12f62767d427736e5cab200c55ed66521170b3fc0ce31d6a

Download Submit
memory/540-138-0x0000024366750000-0x0000024366751000-memory.dmp

Filesize
4KB

Download
memory/540-145-0x0000024366750000-0x0000024366751000-memory.dmp

Filesize
4KB

Download
memory/540-136-0x0000024366750000-0x0000024366751000-memory.dmp

Filesize
4KB

Download
memory/540-146-0x0000024366750000-0x0000024366751000-memory.dmp

Filesize
4KB

Download
memory/540-142-0x0000024366750000-0x0000024366751000-memory.dmp

Filesize
4KB

Download
memory/540-144-0x0000024366750000-0x0000024366751000-memory.dmp

Filesize
4KB

Download
memory/540-143-0x0000024366750000-0x0000024366751000-memory.dmp

Filesize
4KB

Download
memory/540-137-0x0000024366750000-0x0000024366751000-memory.dmp

Filesize
4KB

Download
memory/540-147-0x0000024366750000-0x0000024366751000-memory.dmp

Filesize
4KB

Download
memory/540-148-0x0000024366750000-0x0000024366751000-memory.dmp

Filesize
4KB

Download
memory/804-260-0x00007FF66A520000-0x00007FF66AF19000-memory.dmp

Filesize
10.0MB

Download
memory/1404-152-0x000000001AD20000-0x000000001AD30000-memory.dmp

Filesize
64KB

Download
memory/1560-255-0x0000000001860000-0x000000000186D000-memory.dmp

Filesize
52KB

Download
memory/1560-254-0x0000000001840000-0x0000000001849000-memory.dmp

Filesize
36KB

Download
memory/1560-246-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1560-252-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1560-248-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1628-251-0x0000000005760000-0x0000000005770000-memory.dmp

Filesize
64KB

Download
memory/1628-244-0x0000000003070000-0x000000000307A000-memory.dmp

Filesize
40KB

Download
memory/1628-288-0x0000000005760000-0x0000000005770000-memory.dmp

Filesize
64KB

Download
memory/1628-236-0x0000000005C80000-0x0000000006224000-memory.dmp

Filesize
5.6MB

Download
memory/1628-240-0x0000000005770000-0x0000000005802000-memory.dmp

Filesize
584KB

Download
memory/1628-287-0x0000000005760000-0x0000000005770000-memory.dmp

Filesize
64KB

Download
memory/1628-261-0x00000000082D0000-0x0000000008336000-memory.dmp

Filesize
408KB

Download
memory/1628-259-0x0000000005760000-0x0000000005770000-memory.dmp

Filesize
64KB

Download
memory/1628-223-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1628-250-0x00000000056D0000-0x0000000005726000-memory.dmp

Filesize
344KB

Download
memory/1628-231-0x0000000005630000-0x00000000056CC000-memory.dmp

Filesize
624KB

Download
memory/2108-217-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2108-200-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/2468-133-0x0000000000060000-0x0000000000068000-memory.dmp

Filesize
32KB

Download
memory/2468-134-0x000000001ADA0000-0x000000001ADB0000-memory.dmp

Filesize
64KB

Download
memory/2468-135-0x000000001ADA0000-0x000000001ADB0000-memory.dmp

Filesize
64KB

Download
memory/3808-202-0x000002B151480000-0x000002B1514F6000-memory.dmp

Filesize
472KB

Download
memory/3808-198-0x000002B136F70000-0x000002B137000000-memory.dmp

Filesize
576KB

Download
memory/3808-222-0x000002B151460000-0x000002B151470000-memory.dmp

Filesize
64KB

Download
memory/3808-206-0x000002B137360000-0x000002B13737E000-memory.dmp

Filesize
120KB

Download
memory/4432-242-0x0000000006F80000-0x0000000006F92000-memory.dmp

Filesize
72KB

Download
memory/4432-253-0x0000000007050000-0x0000000007060000-memory.dmp

Filesize
64KB

Download
memory/4432-245-0x00000000070B0000-0x00000000071BA000-memory.dmp

Filesize
1.0MB

Download
memory/4432-247-0x0000000006FE0000-0x000000000701C000-memory.dmp

Filesize
240KB

Download
memory/4432-241-0x0000000007560000-0x0000000007B78000-memory.dmp

Filesize
6.1MB

Download
memory/4432-233-0x0000000000610000-0x0000000000638000-memory.dmp

Filesize
160KB

Download
memory/4800-224-0x00000243800A0000-0x00000243800B0000-memory.dmp

Filesize
64KB

Download
memory/4800-218-0x00000243800A0000-0x00000243800B0000-memory.dmp

Filesize
64KB

Download
memory/4800-196-0x00000243800A0000-0x00000243800B0000-memory.dmp

Filesize
64KB

Download
memory/4800-195-0x00000243800A0000-0x00000243800B0000-memory.dmp

Filesize
64KB

Download
memory/4800-193-0x00000243E79E0000-0x00000243E7A02000-memory.dmp

Filesize
136KB

Download