phobos | 2adc3512b51b70e8a5d6093aa342e5c12fa13e60bc4587e311f504709895c043

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
28-08-2023 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2adc3512b51b70e8a5d6093aa342e5c12fa13e60bc4587e311f504709895c043.exe
Size

343KB
MD5

5bcdc56c88b5ed743ebeebb0bda7e034
SHA1

d04fc0c54d725943faa976cab0a9ea9a576d6d9c
SHA256

2adc3512b51b70e8a5d6093aa342e5c12fa13e60bc4587e311f504709895c043
SHA512

1537da4fb37c9c22c7e298e575c333734d7e3f4532bde1a1dfb52501d0b6033188f860ba99df9fa2779e50c2e0769a80ebe566e3ea9a6b5e7ba47766ca33b1c7
SSDEEP

6144:SCGaECnpAoDO1A8dg3iTPJLMfgQZX+tJs0dx+b6a:DGHCnaomAEg3uPdkgOX+tZdxJa

Score

10^/10

phobos evasion persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\info.hta

Ransom Note

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01//EN' 'http://www.w3.org/TR/html4/strict.dtd'> <html> <head> <meta charset='windows-1251'> <title>encrypted</title> <HTA:APPLICATION ICON='msiexec.exe' SINGLEINSTANCE='yes' SysMenu="no"> <script language='JScript'> window.moveTo(50, 50); window.resizeTo(screen.width - 100, screen.height - 100); </script> <style type='text/css'> body { font: 15px Tahoma, sans-serif; margin: 10px; line-height: 25px; background: #EDEDED; } img { display:inline-block; } .bold { font-weight: bold; } .mark { background: #D0D0E8; padding: 2px 5px; } .header { text-align: center; font-size: 30px; line-height: 50px; font-weight: bold; margin-bottom:20px; } .info { background: #D0D0E8; border-left: 10px solid #00008B; } .alert { background: #FFE4E4; border-left: 10px solid #FF0000; } .private { border: 1px dashed #000; background: #FFFFEF; } .note { height: auto; padding-bottom: 1px; margin: 15px 0; } .note .title { font-weight: bold; text-indent: 10px; height: 30px; line-height: 30px; padding-top: 10px; } .note .mark { background: #A2A2B5; } .note ul { margin-top: 0; } .note pre { margin-left: 15px; line-height: 13px; font-size: 13px; } .footer { position:fixed; bottom:0; right:0; text-align: right; } </style> </head> <body> <div class='header'> <img src='data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAQAAAAAYLlVAAAABGdBTUEAALGPC/xhBQAAACBjSFJNAAB6JQAAgIMAAPn/AACA6QAAdTAAAOpgAAA6mAAAF2+SX8VGAAAAAmJLR0QA/4ePzL8AAAAJcEhZcwAACxMAAAsTAQCanBgAAAAHdElNRQfjAwwMJwSFwIn8AAADNklEQVRo3u2ZTUhUURTHfzozmprmZ1pYEmkfJNEmiwwkSEyFECIQpEUboYhqFYHQXlcti9rUKldWBEUiuQpbtDDNzD5G8qM0HRXLRtO5LdJx3puPd++8+xyIztm88zgf/3veufeee18SdimDI1RxnL0U4gbAzxhDdPGCfpZs+49JWTTyFB8iAq8wTju1pDgXvopOliIGX+d57rHPieBuLvLNIvgaD1KvP/x1FiTDCwQTNOkFcJVfCuEFgq+c0he+minF8AJBH2WRnCUph8/nIZVhb2d5w1smEbjYSTn7SQ/TucsFlnWkPxBW6Xc4RkbIoHKooSNshsxRbT98Eb0mtyM04oqgmR6hUNvtrwrnWDa4nOVMVF0XLfw2aPuosBfezQPTmNpiVtFmnpj0W+wBKMFrcPeJ3RYWNfwwWHSSZgdAHX6Du5uWFpl0myqm1KiQrASgnNQQaZFOS4t5nhvkAnbZAbDHIE0wIGHzmsUQKdXkQwlACtsN8ijfJay8zBjkovgBbCLPlAG/hNUcswa5IH4Ayasdzxr5pBbWRRYMstGHYg04QAkH4FbQFSwTCKbdI7mzWVipbMceKtiCCFqO0OeY1caRbAaKOcgOCpQ+WWTyM8EwvfjkTfJoYZDFONqwaPyTHs7LbktlPNMYep2XuE22dfhsHjkS/i+3Wn/SK2EdoE72UeuyGH8rxbbLLjqlkRlb4TAzDo5fIJiOvRTnR+ju9VJuwveC/wASDsD+2h5KUyyQTVZiALzjFt3MsY16mtmqx2mt9BbUw4EQuzpGpVcCLQB8nDBZXmJFDoCeInzFS9ObxwzLmeoBMGA4/QBM4t1IAOHXDi7Zqwg9ACrCWotS8xnQWQCHOGsafzOFOhzLT8NxmoI3RZncULjG1ARA8DHYupxUucbUtxd4ghnw4JI30wdARHneMABx0j8FYD3xCkdefQByKFl9KsOjy6nKNBR0cZRCTjOk1JhrBCCY5r3pZtSS9bZkueSqmljVgPoPDa0Algk4HD8QG8AXph0G8Dk2AC89DgPosFKodvR83G/dtiRzTevtUChP0SCTpBQuM+bI6Bvk51gl96X/FFvzCh9oW0v+H2zO2tYtz/EgAAAAJXRFWHRkYXRlOmNyZWF0ZQAyMDE5LTAzLTEyVDEyOjM5OjA0KzAwOjAwG6lIYwAAACV0RVh0ZGF0ZTptb2RpZnkAMjAxOS0wMy0xMlQxMjozOTowNCswMDowMGr08N8AAAAASUVORK5CYII='> <div>ATTENTION!!!!</div> </div> <div class='bold'>Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted with ciphers more advanced than those used for diplomatic communications, you can spend days and months searching for a magical way to decrypt your files, but rest assured we are the only people who can help you recover your files, there is no free tool</div> <div class='bold'>If you want to restore them, install ICQ software on your PC <span class='mark'><a href='https://icq.com/windows/'>https://icq.com/windows/</a></span> or on your mobile phone search in Appstore / Google market "ICQ"</div> <div class='bold'>Write to our ICQ @FIREYOURITGUY <span class='mark'><a href='https://icq.im/FIREYOURITGUY'>https://icq.im/FIREYOURITGUY</a></span></div> <div class='bold'>Write this ID in the title of your message <span class='mark'>F581A117-2797</span></div> <div class='note info'> <div class='title'>Free decryption as guarantee</div> <ul>Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) </ul> </div> <div class='note alert'> <div class='title'>Attention!</div> <ul> <li>Do not rename encrypted files.</li> <li>Do not try to decrypt your data using third party software, it may cause permanent data loss.</li> <li>Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.</li> </ul> </div> </body> </html>

URLs

http://www.w3.org/TR/html4/strict.dtd'>

Extracted

Path

C:\Users\Admin\Desktop\info.hta

Ransom Note

ATTENTION!!!! Unfortunately for you, a major IT security weakness left you open to attack, your files have been encrypted with ciphers more advanced than those used for diplomatic communications, you can spend days and months searching for a magical way to decrypt your files, but rest assured we are the only people who can help you recover your files, there is no free tool If you want to restore them, install ICQ software on your PC https://icq.com/windows/ or on your mobile phone search in Appstore / Google market "ICQ" Write to our ICQ @FIREYOURITGUY https://icq.im/FIREYOURITGUY Write this ID in the title of your message F581A117-2797 Free decryption as guarantee Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

URLs

https://icq.com/windows/

https://icq.im/FIREYOURITGUY

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

2004 bcdedit.exe
2328 bcdedit.exe
3964 bcdedit.exe
5000 bcdedit.exe
Renames multiple (473) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command and Scripting Interpreter
T1059

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

948 wbadmin.exe
1716 wbadmin.exe
Modifies Windows Firewall 1 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Processes:

netsh.exenetsh.exe

pid process

4760 netsh.exe
4428 netsh.exe

pid	process
2004	bcdedit.exe
2328	bcdedit.exe
3964	bcdedit.exe
5000	bcdedit.exe

pid	process
948	wbadmin.exe
1716	wbadmin.exe

pid	process
4760	netsh.exe
4428	netsh.exe

Drops startup file 3 IoCs

Processes:

update.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\update.exe	update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	update.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe

Executes dropped EXE 2 IoCs

Processes:

update.exeupdate.exe

pid process

2456 update.exe
920 update.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

update.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Local\\update.exe"	update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\update = "C:\\Users\\Admin\\AppData\\Local\\update.exe"	update.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

update.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\desktop.ini	update.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	update.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	update.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	update.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	update.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	update.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	update.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini	update.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	update.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	update.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	update.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	update.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	update.exe
File opened for modification	C:\Program Files\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	update.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	update.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	update.exe
File opened for modification	C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini	update.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	update.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	update.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	update.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	update.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	update.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	update.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	update.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-618519468-4027732583-1827558364-1000\desktop.ini	update.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	update.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	update.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	update.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-618519468-4027732583-1827558364-1000\desktop.ini	update.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini	update.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	update.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	update.exe
File opened for modification	C:\Users\Public\desktop.ini	update.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\desktop.ini	update.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	update.exe

Drops file in Program Files directory 64 IoCs

Processes:

update.exe

description	ioc	process
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\ui-strings.js.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected][F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-core-multitabs_zh_CN.jar	update.exe
File created	C:\Program Files\Java\jre1.8.0_66\lib\cmm\sRGB.pf.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-150.png	update.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\Microsoft.Build.Conversion.v3.5.resources.dll	update.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\it-it\ui-strings.js	update.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode-2x.png	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019VL_KMS_Client_AE-ppd.xrm-ms	update.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-phn.xrm-ms	update.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE.HXS.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe	update.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	update.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files-select\css\main-selector.css.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\MICROSOFT.DATA.RECOMMENDATION.COMMON.DLL	update.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\javax.xml_1.3.4.v201005080400.jar	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.boot.tree.dat	update.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\jscripts\winrthost.js	update.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-32_altform-unplated_contrast-black.png	update.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\sk.pak.DATA.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssrb.xml	update.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\OutlookMailLargeTile.scale-125.png	update.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml	update.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\AppCS\webviewBoot.min.js	update.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\lib\nbexec64.dll	update.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageSmallTile.scale-150_contrast-black.png	update.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxMailLargeTile.scale-150.png	update.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\it\System.Printing.resources.dll	update.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\images\themes\dark\rhp_world_icon.png	update.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019R_Grace-ppd.xrm-ms.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\libdmo_plugin.dll	update.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_neutral_split.scale-100_kzf8qxf38zg5c\AppxManifest.xml	update.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsLargeTile.contrast-white_scale-200.png	update.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\ui-strings.js	update.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxCalendarSplashLogo.scale-250.png	update.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\protect_poster.jpg.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File created	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-pl.xrm-ms.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms	update.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ul-phn.xrm-ms.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-20_altform-unplated.png	update.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\share_icons.png	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\IEEE2006OfficeOnline.xsl	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STUDIO\STUDIO.INF	update.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MicrosoftLogo.scale-200.png	update.exe
File created	C:\Program Files\Microsoft Office\root\rsod\onenotemui.msi.16.en-us.tree.dat.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\de-DE\MSFT_PackageManagement.schema.mfl	update.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ms.pak	update.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-modules-startup.xml	update.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\nl_get.svg.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\msedgeupdateres_hi.dll.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\close.svg	update.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\en-ae\ui-strings.js.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File created	C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pkeyconfig-office.xrm-ms.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\fxplugins.dll	update.exe
File created	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup	update.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ppd.xrm-ms	update.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Images\HelpAndFeedback\VideoThumbnail.png	update.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\offsymt.ttf	update.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

3864 vssadmin.exe
4104 vssadmin.exe
Modifies registry class 1 IoCs

Processes:

update.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings update.exe

pid	process
3864	vssadmin.exe
4104	vssadmin.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	update.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

update.exe

pid	process
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe
2456	update.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

update.exevssvc.exeWMIC.exewbengine.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2456	update.exe
Token: SeBackupPrivilege	3856	vssvc.exe
Token: SeRestorePrivilege	3856	vssvc.exe
Token: SeAuditPrivilege	3856	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2552	WMIC.exe
Token: SeSecurityPrivilege	2552	WMIC.exe
Token: SeTakeOwnershipPrivilege	2552	WMIC.exe
Token: SeLoadDriverPrivilege	2552	WMIC.exe
Token: SeSystemProfilePrivilege	2552	WMIC.exe
Token: SeSystemtimePrivilege	2552	WMIC.exe
Token: SeProfSingleProcessPrivilege	2552	WMIC.exe
Token: SeIncBasePriorityPrivilege	2552	WMIC.exe
Token: SeCreatePagefilePrivilege	2552	WMIC.exe
Token: SeBackupPrivilege	2552	WMIC.exe
Token: SeRestorePrivilege	2552	WMIC.exe
Token: SeShutdownPrivilege	2552	WMIC.exe
Token: SeDebugPrivilege	2552	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2552	WMIC.exe
Token: SeRemoteShutdownPrivilege	2552	WMIC.exe
Token: SeUndockPrivilege	2552	WMIC.exe
Token: SeManageVolumePrivilege	2552	WMIC.exe
Token: 33	2552	WMIC.exe
Token: 34	2552	WMIC.exe
Token: 35	2552	WMIC.exe
Token: 36	2552	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2552	WMIC.exe
Token: SeSecurityPrivilege	2552	WMIC.exe
Token: SeTakeOwnershipPrivilege	2552	WMIC.exe
Token: SeLoadDriverPrivilege	2552	WMIC.exe
Token: SeSystemProfilePrivilege	2552	WMIC.exe
Token: SeSystemtimePrivilege	2552	WMIC.exe
Token: SeProfSingleProcessPrivilege	2552	WMIC.exe
Token: SeIncBasePriorityPrivilege	2552	WMIC.exe
Token: SeCreatePagefilePrivilege	2552	WMIC.exe
Token: SeBackupPrivilege	2552	WMIC.exe
Token: SeRestorePrivilege	2552	WMIC.exe
Token: SeShutdownPrivilege	2552	WMIC.exe
Token: SeDebugPrivilege	2552	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2552	WMIC.exe
Token: SeRemoteShutdownPrivilege	2552	WMIC.exe
Token: SeUndockPrivilege	2552	WMIC.exe
Token: SeManageVolumePrivilege	2552	WMIC.exe
Token: 33	2552	WMIC.exe
Token: 34	2552	WMIC.exe
Token: 35	2552	WMIC.exe
Token: 36	2552	WMIC.exe
Token: SeBackupPrivilege	1812	wbengine.exe
Token: SeRestorePrivilege	1812	wbengine.exe
Token: SeSecurityPrivilege	1812	wbengine.exe
Token: SeIncreaseQuotaPrivilege	4240	WMIC.exe
Token: SeSecurityPrivilege	4240	WMIC.exe
Token: SeTakeOwnershipPrivilege	4240	WMIC.exe
Token: SeLoadDriverPrivilege	4240	WMIC.exe
Token: SeSystemProfilePrivilege	4240	WMIC.exe
Token: SeSystemtimePrivilege	4240	WMIC.exe
Token: SeProfSingleProcessPrivilege	4240	WMIC.exe
Token: SeIncBasePriorityPrivilege	4240	WMIC.exe
Token: SeCreatePagefilePrivilege	4240	WMIC.exe
Token: SeBackupPrivilege	4240	WMIC.exe
Token: SeRestorePrivilege	4240	WMIC.exe
Token: SeShutdownPrivilege	4240	WMIC.exe
Token: SeDebugPrivilege	4240	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4240	WMIC.exe
Token: SeRemoteShutdownPrivilege	4240	WMIC.exe

Suspicious use of WriteProcessMemory 45 IoCs

Processes:

2adc3512b51b70e8a5d6093aa342e5c12fa13e60bc4587e311f504709895c043.exeupdate.execmd.execmd.execmd.exe

description	pid	process	target process
PID 4668 wrote to memory of 2456	4668	2adc3512b51b70e8a5d6093aa342e5c12fa13e60bc4587e311f504709895c043.exe	update.exe
PID 4668 wrote to memory of 2456	4668	2adc3512b51b70e8a5d6093aa342e5c12fa13e60bc4587e311f504709895c043.exe	update.exe
PID 4668 wrote to memory of 2456	4668	2adc3512b51b70e8a5d6093aa342e5c12fa13e60bc4587e311f504709895c043.exe	update.exe
PID 2456 wrote to memory of 5040	2456	update.exe	cmd.exe
PID 2456 wrote to memory of 5040	2456	update.exe	cmd.exe
PID 2456 wrote to memory of 4248	2456	update.exe	cmd.exe
PID 2456 wrote to memory of 4248	2456	update.exe	cmd.exe
PID 4248 wrote to memory of 4760	4248	cmd.exe	netsh.exe
PID 4248 wrote to memory of 4760	4248	cmd.exe	netsh.exe
PID 5040 wrote to memory of 3864	5040	cmd.exe	vssadmin.exe
PID 5040 wrote to memory of 3864	5040	cmd.exe	vssadmin.exe
PID 4248 wrote to memory of 4428	4248	cmd.exe	netsh.exe
PID 4248 wrote to memory of 4428	4248	cmd.exe	netsh.exe
PID 5040 wrote to memory of 2552	5040	cmd.exe	WMIC.exe
PID 5040 wrote to memory of 2552	5040	cmd.exe	WMIC.exe
PID 5040 wrote to memory of 2004	5040	cmd.exe	bcdedit.exe
PID 5040 wrote to memory of 2004	5040	cmd.exe	bcdedit.exe
PID 5040 wrote to memory of 2328	5040	cmd.exe	bcdedit.exe
PID 5040 wrote to memory of 2328	5040	cmd.exe	bcdedit.exe
PID 5040 wrote to memory of 948	5040	cmd.exe	wbadmin.exe
PID 5040 wrote to memory of 948	5040	cmd.exe	wbadmin.exe
PID 2456 wrote to memory of 2100	2456	update.exe	mshta.exe
PID 2456 wrote to memory of 2100	2456	update.exe	mshta.exe
PID 2456 wrote to memory of 2100	2456	update.exe	mshta.exe
PID 2456 wrote to memory of 4632	2456	update.exe	mshta.exe
PID 2456 wrote to memory of 4632	2456	update.exe	mshta.exe
PID 2456 wrote to memory of 4632	2456	update.exe	mshta.exe
PID 2456 wrote to memory of 2592	2456	update.exe	mshta.exe
PID 2456 wrote to memory of 2592	2456	update.exe	mshta.exe
PID 2456 wrote to memory of 2592	2456	update.exe	mshta.exe
PID 2456 wrote to memory of 4312	2456	update.exe	mshta.exe
PID 2456 wrote to memory of 4312	2456	update.exe	mshta.exe
PID 2456 wrote to memory of 4312	2456	update.exe	mshta.exe
PID 2456 wrote to memory of 5028	2456	update.exe	cmd.exe
PID 2456 wrote to memory of 5028	2456	update.exe	cmd.exe
PID 5028 wrote to memory of 4104	5028	cmd.exe	vssadmin.exe
PID 5028 wrote to memory of 4104	5028	cmd.exe	vssadmin.exe
PID 5028 wrote to memory of 4240	5028	cmd.exe	WMIC.exe
PID 5028 wrote to memory of 4240	5028	cmd.exe	WMIC.exe
PID 5028 wrote to memory of 3964	5028	cmd.exe	bcdedit.exe
PID 5028 wrote to memory of 3964	5028	cmd.exe	bcdedit.exe
PID 5028 wrote to memory of 5000	5028	cmd.exe	bcdedit.exe
PID 5028 wrote to memory of 5000	5028	cmd.exe	bcdedit.exe
PID 5028 wrote to memory of 1716	5028	cmd.exe	wbadmin.exe
PID 5028 wrote to memory of 1716	5028	cmd.exe	wbadmin.exe

C:\Users\Admin\AppData\Local\Temp\2adc3512b51b70e8a5d6093aa342e5c12fa13e60bc4587e311f504709895c043.exe
"C:\Users\Admin\AppData\Local\Temp\2adc3512b51b70e8a5d6093aa342e5c12fa13e60bc4587e311f504709895c043.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4668

C:\Windows\Temp\update.exe
"C:\Windows\Temp\update.exe"
2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\Temp\update.exe
"C:\Windows\Temp\update.exe"
3⤵
- Executes dropped EXE
PID:920

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:5040

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:3864

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:2004

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:2328

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:948

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:4248

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
4⤵
- Modifies Windows Firewall
PID:4760

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
4⤵
- Modifies Windows Firewall
PID:4428

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
PID:2100

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
PID:4632

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
PID:2592

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "F:\info.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
3⤵
PID:4312

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:5028

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
4⤵
- Interacts with shadow copies
PID:4104

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4240

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
4⤵
- Modifies boot configuration data using bcdedit
PID:3964

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
4⤵
- Modifies boot configuration data using bcdedit
PID:5000

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
4⤵
- Deletes backup catalog
PID:1716

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3856

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1812

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1892

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:3468

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll.id[F581A117-2797].[ICQ@FIREYOURITGUY].messedup
Filesize
3.2MB

MD5
fa2402efa82d4118d8aaba7e1bb9dfc1

SHA1
da1d05c0da0ae89f900d7c47d3986fd9a0503b58

SHA256
9061e05236ba2ca05dd35be404837e066a29b278c6fbabc9de7fe1dd64c534fb

SHA512
306b4c8943447cc4ac96e41944085db1f364d84606aee05e23b4509778ae97b7c730f178a97efd12bf7f15b0675b7e8cb5a2e0c4caac6f6fbe14c5d7b425b231

Download Submit
C:\Users\Admin\Desktop\info.hta
Filesize
4KB

MD5
312d80ead4a93902ca36a6f487028e83

SHA1
b08119b858b146bd0d17439d3707dd48aa59454b

SHA256
e10528125dc0ac2077293b5b7f5d85350145de9c1754e36ac84069b29da894ba

SHA512
6e01d2a6c4b6789fc15ce15b8c160cd3296e3fcae02a15484a6c93f57c21c8eac0bb101d2d4d201af56023ebbcd2deba1eca938a2e00bc0929d5676840bf29b0

Download Submit
C:\Windows\Temp\update.exe
Filesize
55KB

MD5
af5f882e78ea88b41b0dfbe327cdfdb9

SHA1
62b65def66d9ef39f1b11b8c987e71cad07b9837

SHA256
3d4a18a66658bdae299d2334de4043b54cb6ae06f776362831eba6669e9a962b

SHA512
831d65eb65c4b26f1db5fd6a9512af004113566bfac933b21cd326d8df2f329216c90f1db8f23bb72f3a3c229f00b7bf005277deaed8579cfe81f27221b9d934

Download Submit
C:\Windows\Temp\update.exe
Filesize
55KB

MD5
af5f882e78ea88b41b0dfbe327cdfdb9

SHA1
62b65def66d9ef39f1b11b8c987e71cad07b9837

SHA256
3d4a18a66658bdae299d2334de4043b54cb6ae06f776362831eba6669e9a962b

SHA512
831d65eb65c4b26f1db5fd6a9512af004113566bfac933b21cd326d8df2f329216c90f1db8f23bb72f3a3c229f00b7bf005277deaed8579cfe81f27221b9d934

Download Submit
C:\Windows\Temp\update.exe
Filesize
55KB

MD5
af5f882e78ea88b41b0dfbe327cdfdb9

SHA1
62b65def66d9ef39f1b11b8c987e71cad07b9837

SHA256
3d4a18a66658bdae299d2334de4043b54cb6ae06f776362831eba6669e9a962b

SHA512
831d65eb65c4b26f1db5fd6a9512af004113566bfac933b21cd326d8df2f329216c90f1db8f23bb72f3a3c229f00b7bf005277deaed8579cfe81f27221b9d934

Download Submit
C:\Windows\Temp\update.exe
Filesize
55KB

MD5
af5f882e78ea88b41b0dfbe327cdfdb9

SHA1
62b65def66d9ef39f1b11b8c987e71cad07b9837

SHA256
3d4a18a66658bdae299d2334de4043b54cb6ae06f776362831eba6669e9a962b

SHA512
831d65eb65c4b26f1db5fd6a9512af004113566bfac933b21cd326d8df2f329216c90f1db8f23bb72f3a3c229f00b7bf005277deaed8579cfe81f27221b9d934

Download Submit
C:\info.hta
Filesize
4KB

MD5
312d80ead4a93902ca36a6f487028e83

SHA1
b08119b858b146bd0d17439d3707dd48aa59454b

SHA256
e10528125dc0ac2077293b5b7f5d85350145de9c1754e36ac84069b29da894ba

SHA512
6e01d2a6c4b6789fc15ce15b8c160cd3296e3fcae02a15484a6c93f57c21c8eac0bb101d2d4d201af56023ebbcd2deba1eca938a2e00bc0929d5676840bf29b0

Download Submit
C:\info.hta
Filesize
4KB

MD5
312d80ead4a93902ca36a6f487028e83

SHA1
b08119b858b146bd0d17439d3707dd48aa59454b

SHA256
e10528125dc0ac2077293b5b7f5d85350145de9c1754e36ac84069b29da894ba

SHA512
6e01d2a6c4b6789fc15ce15b8c160cd3296e3fcae02a15484a6c93f57c21c8eac0bb101d2d4d201af56023ebbcd2deba1eca938a2e00bc0929d5676840bf29b0

Download Submit
C:\users\public\desktop\info.hta
Filesize
4KB

MD5
312d80ead4a93902ca36a6f487028e83

SHA1
b08119b858b146bd0d17439d3707dd48aa59454b

SHA256
e10528125dc0ac2077293b5b7f5d85350145de9c1754e36ac84069b29da894ba

SHA512
6e01d2a6c4b6789fc15ce15b8c160cd3296e3fcae02a15484a6c93f57c21c8eac0bb101d2d4d201af56023ebbcd2deba1eca938a2e00bc0929d5676840bf29b0

Download Submit
F:\info.hta
Filesize
4KB

MD5
312d80ead4a93902ca36a6f487028e83

SHA1
b08119b858b146bd0d17439d3707dd48aa59454b

SHA256
e10528125dc0ac2077293b5b7f5d85350145de9c1754e36ac84069b29da894ba

SHA512
6e01d2a6c4b6789fc15ce15b8c160cd3296e3fcae02a15484a6c93f57c21c8eac0bb101d2d4d201af56023ebbcd2deba1eca938a2e00bc0929d5676840bf29b0

Download Submit