bed591cfa167c212c5e927939dff1c62bf673c94456d693109054a458446dc44

Analysis

max time kernel
72s
max time network
131s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
30/08/2023, 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bed591cfa167c212c5e927939dff1c62bf673c94456d693109054a458446dc44.exe
Size

1.4MB
MD5

86f6598c6c7558f62d7437011a0bb222
SHA1

6ed5467a08a40c7af717dbbf993d2a9897db7ee8
SHA256

bed591cfa167c212c5e927939dff1c62bf673c94456d693109054a458446dc44
SHA512

676c00e6ce5b5a630bb214d87df2e53f96d2e1a2113488df83706ebf5abebe601174155d4f4d04429401b507a8a83afb440746c7800065cfc10eda3243210c94
SSDEEP

24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score

8^/10

evasion persistence upx

Malware Config

Signatures

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
4660	netsh.exe
3904	netsh.exe

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000700000001b017-132.dat	acprotect
behavioral1/files/0x000700000001b017-133.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
5028	7z.exe
4984	ratt.exe
3532	ratt.exe

Loads dropped DLL 1 IoCs

pid	Process
5028	7z.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000001b01b-128.dat	upx
behavioral1/memory/5028-130-0x0000000000400000-0x0000000000432000-memory.dmp	upx
behavioral1/files/0x000700000001b01b-131.dat	upx
behavioral1/files/0x000700000001b017-132.dat	upx
behavioral1/files/0x000700000001b017-133.dat	upx
behavioral1/memory/5028-134-0x0000000010000000-0x00000000100E2000-memory.dmp	upx
behavioral1/memory/5028-138-0x0000000000400000-0x0000000000432000-memory.dmp	upx

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ratt = "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\ratt.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery

T1018

pid	Process
876	PING.EXE
4976	PING.EXE
1448	PING.EXE
3096	PING.EXE

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
4888	powershell.exe
4888	powershell.exe
4888	powershell.exe
216	powershell.exe
216	powershell.exe
216	powershell.exe
4440	powershell.exe
4440	powershell.exe
4440	powershell.exe
4176	powershell.exe
4176	powershell.exe
4176	powershell.exe
4504	powershell.exe
4504	powershell.exe
4504	powershell.exe
4768	powershell.exe
4768	powershell.exe
4768	powershell.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
4984	ratt.exe
3532	ratt.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2716	WMIC.exe
Token: SeSecurityPrivilege	2716	WMIC.exe
Token: SeTakeOwnershipPrivilege	2716	WMIC.exe
Token: SeLoadDriverPrivilege	2716	WMIC.exe
Token: SeSystemProfilePrivilege	2716	WMIC.exe
Token: SeSystemtimePrivilege	2716	WMIC.exe
Token: SeProfSingleProcessPrivilege	2716	WMIC.exe
Token: SeIncBasePriorityPrivilege	2716	WMIC.exe
Token: SeCreatePagefilePrivilege	2716	WMIC.exe
Token: SeBackupPrivilege	2716	WMIC.exe
Token: SeRestorePrivilege	2716	WMIC.exe
Token: SeShutdownPrivilege	2716	WMIC.exe
Token: SeDebugPrivilege	2716	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2716	WMIC.exe
Token: SeRemoteShutdownPrivilege	2716	WMIC.exe
Token: SeUndockPrivilege	2716	WMIC.exe
Token: SeManageVolumePrivilege	2716	WMIC.exe
Token: 33	2716	WMIC.exe
Token: 34	2716	WMIC.exe
Token: 35	2716	WMIC.exe
Token: 36	2716	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2716	WMIC.exe
Token: SeSecurityPrivilege	2716	WMIC.exe
Token: SeTakeOwnershipPrivilege	2716	WMIC.exe
Token: SeLoadDriverPrivilege	2716	WMIC.exe
Token: SeSystemProfilePrivilege	2716	WMIC.exe
Token: SeSystemtimePrivilege	2716	WMIC.exe
Token: SeProfSingleProcessPrivilege	2716	WMIC.exe
Token: SeIncBasePriorityPrivilege	2716	WMIC.exe
Token: SeCreatePagefilePrivilege	2716	WMIC.exe
Token: SeBackupPrivilege	2716	WMIC.exe
Token: SeRestorePrivilege	2716	WMIC.exe
Token: SeShutdownPrivilege	2716	WMIC.exe
Token: SeDebugPrivilege	2716	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2716	WMIC.exe
Token: SeRemoteShutdownPrivilege	2716	WMIC.exe
Token: SeUndockPrivilege	2716	WMIC.exe
Token: SeManageVolumePrivilege	2716	WMIC.exe
Token: 33	2716	WMIC.exe
Token: 34	2716	WMIC.exe
Token: 35	2716	WMIC.exe
Token: 36	2716	WMIC.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	216	powershell.exe
Token: SeDebugPrivilege	4440	powershell.exe
Token: SeDebugPrivilege	4176	powershell.exe
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	4768	powershell.exe
Token: SeIncreaseQuotaPrivilege	212	WMIC.exe
Token: SeSecurityPrivilege	212	WMIC.exe
Token: SeTakeOwnershipPrivilege	212	WMIC.exe
Token: SeLoadDriverPrivilege	212	WMIC.exe
Token: SeSystemProfilePrivilege	212	WMIC.exe
Token: SeSystemtimePrivilege	212	WMIC.exe
Token: SeProfSingleProcessPrivilege	212	WMIC.exe
Token: SeIncBasePriorityPrivilege	212	WMIC.exe
Token: SeCreatePagefilePrivilege	212	WMIC.exe
Token: SeBackupPrivilege	212	WMIC.exe
Token: SeRestorePrivilege	212	WMIC.exe
Token: SeShutdownPrivilege	212	WMIC.exe
Token: SeDebugPrivilege	212	WMIC.exe
Token: SeSystemEnvironmentPrivilege	212	WMIC.exe
Token: SeRemoteShutdownPrivilege	212	WMIC.exe
Token: SeUndockPrivilege	212	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 2960	3996	bed591cfa167c212c5e927939dff1c62bf673c94456d693109054a458446dc44.exe	70
PID 3996 wrote to memory of 2960	3996	bed591cfa167c212c5e927939dff1c62bf673c94456d693109054a458446dc44.exe	70
PID 3996 wrote to memory of 2960	3996	bed591cfa167c212c5e927939dff1c62bf673c94456d693109054a458446dc44.exe	70
PID 2960 wrote to memory of 3988	2960	cmd.exe	73
PID 2960 wrote to memory of 3988	2960	cmd.exe	73
PID 2960 wrote to memory of 3988	2960	cmd.exe	73
PID 3988 wrote to memory of 4112	3988	cmd.exe	74
PID 3988 wrote to memory of 4112	3988	cmd.exe	74
PID 3988 wrote to memory of 4112	3988	cmd.exe	74
PID 2960 wrote to memory of 4676	2960	cmd.exe	75
PID 2960 wrote to memory of 4676	2960	cmd.exe	75
PID 2960 wrote to memory of 4676	2960	cmd.exe	75
PID 4676 wrote to memory of 2716	4676	cmd.exe	76
PID 4676 wrote to memory of 2716	4676	cmd.exe	76
PID 4676 wrote to memory of 2716	4676	cmd.exe	76
PID 2960 wrote to memory of 4888	2960	cmd.exe	78
PID 2960 wrote to memory of 4888	2960	cmd.exe	78
PID 2960 wrote to memory of 4888	2960	cmd.exe	78
PID 2960 wrote to memory of 216	2960	cmd.exe	79
PID 2960 wrote to memory of 216	2960	cmd.exe	79
PID 2960 wrote to memory of 216	2960	cmd.exe	79
PID 2960 wrote to memory of 4440	2960	cmd.exe	80
PID 2960 wrote to memory of 4440	2960	cmd.exe	80
PID 2960 wrote to memory of 4440	2960	cmd.exe	80
PID 2960 wrote to memory of 4176	2960	cmd.exe	81
PID 2960 wrote to memory of 4176	2960	cmd.exe	81
PID 2960 wrote to memory of 4176	2960	cmd.exe	81
PID 2960 wrote to memory of 4504	2960	cmd.exe	82
PID 2960 wrote to memory of 4504	2960	cmd.exe	82
PID 2960 wrote to memory of 4504	2960	cmd.exe	82
PID 2960 wrote to memory of 5028	2960	cmd.exe	83
PID 2960 wrote to memory of 5028	2960	cmd.exe	83
PID 2960 wrote to memory of 5028	2960	cmd.exe	83
PID 2960 wrote to memory of 4768	2960	cmd.exe	84
PID 2960 wrote to memory of 4768	2960	cmd.exe	84
PID 2960 wrote to memory of 4768	2960	cmd.exe	84
PID 4768 wrote to memory of 4660	4768	powershell.exe	85
PID 4768 wrote to memory of 4660	4768	powershell.exe	85
PID 4768 wrote to memory of 4660	4768	powershell.exe	85
PID 4768 wrote to memory of 3904	4768	powershell.exe	86
PID 4768 wrote to memory of 3904	4768	powershell.exe	86
PID 4768 wrote to memory of 3904	4768	powershell.exe	86
PID 4768 wrote to memory of 4640	4768	powershell.exe	87
PID 4768 wrote to memory of 4640	4768	powershell.exe	87
PID 4768 wrote to memory of 4640	4768	powershell.exe	87
PID 4640 wrote to memory of 212	4640	cmd.exe	88
PID 4640 wrote to memory of 212	4640	cmd.exe	88
PID 4640 wrote to memory of 212	4640	cmd.exe	88
PID 4768 wrote to memory of 4648	4768	powershell.exe	89
PID 4768 wrote to memory of 4648	4768	powershell.exe	89
PID 4768 wrote to memory of 4648	4768	powershell.exe	89
PID 4648 wrote to memory of 3036	4648	cmd.exe	90
PID 4648 wrote to memory of 3036	4648	cmd.exe	90
PID 4648 wrote to memory of 3036	4648	cmd.exe	90
PID 4768 wrote to memory of 4984	4768	powershell.exe	91
PID 4768 wrote to memory of 4984	4768	powershell.exe	91
PID 4768 wrote to memory of 4984	4768	powershell.exe	91
PID 4768 wrote to memory of 4372	4768	powershell.exe	92
PID 4768 wrote to memory of 4372	4768	powershell.exe	92
PID 4768 wrote to memory of 4372	4768	powershell.exe	92
PID 2960 wrote to memory of 3100	2960	cmd.exe	93
PID 2960 wrote to memory of 3100	2960	cmd.exe	93
PID 2960 wrote to memory of 3100	2960	cmd.exe	93
PID 4984 wrote to memory of 1208	4984	ratt.exe	95

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4372	attrib.exe

C:\Users\Admin\AppData\Local\Temp\bed591cfa167c212c5e927939dff1c62bf673c94456d693109054a458446dc44.exe
"C:\Users\Admin\AppData\Local\Temp\bed591cfa167c212c5e927939dff1c62bf673c94456d693109054a458446dc44.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ratt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3988
  - - C:\Windows\SysWOW64\nslookup.exe
      nslookup myip.opendns.com. resolver1.opendns.com
      4⤵
      PID:4112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c wmic ComputerSystem get Domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4676
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ComputerSystem get Domain
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2716
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4888
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:216
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4440
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionPath "$Env:SystemDrive\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4176
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    Powershell -Command 'Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\ratt.exe"'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4504
- - C:\Users\Admin\AppData\Local\Temp\7z.exe
    7z.exe x -o"C:\Users\Admin\AppData\Local\Temp" -y ratt.7z
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5028
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -executionpolicy RemoteSigned -WindowStyle Hidden -file Add.ps1
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=in action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:4660
  - - C:\Windows\SysWOW64\netsh.exe
      "C:\Windows\system32\netsh.exe" advfirewall firewall add rule name=SecuritySystem dir=out action=allow "program=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:3904
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic computersystem where name="CXVLSGIX" set AutomaticManagedPagefile=False
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:212
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4648
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic pagefileset where name="C:\\pagefile.sys" set InitialSize=15000,MaximumSize=20000
        5⤵
        
        PID:3036
  - - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe
      "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:4984
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 8 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        5⤵
        
        PID:1208
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 8
        6⤵
        Runs ping.exe
        
        PID:876
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\Music\rot.exe,"
        6⤵
        
        PID:1584
    - - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 11 > nul && copy "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 11 > nul && "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:2304
      - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 11
        6⤵
        Runs ping.exe
        
        PID:4976
  - - C:\Windows\SysWOW64\attrib.exe
      "C:\Windows\system32\attrib.exe" +h "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe"
      4⤵
      Views/modifies file attributes
      PID:4372
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "ratt" /t REG_SZ /d "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe" /F
    3⤵
    - Adds Run key to start application
    PID:3100
- - C:\Users\Admin\AppData\Local\Temp\ratt.exe
    "ratt.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3532
  - - C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 15 > nul && copy "C:\Users\Admin\AppData\Local\Temp\ratt.exe" "C:\Users\Admin\Music\rot.exe" && ping 127.0.0.1 -n 15 > nul && "C:\Users\Admin\Music\rot.exe"
      4⤵
      PID:2624
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 15
        5⤵
        Runs ping.exe
        
        PID:1448
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 15
        5⤵
        Runs ping.exe
        
        PID:3096
    - - C:\Users\Admin\Music\rot.exe
        
        "C:\Users\Admin\Music\rot.exe"
        5⤵
        
        PID:4364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ratt.exe

Filesize
368.2MB

MD5
719738c86af64b83ace07fa63ea29fec

SHA1
2fdcfcee7aaf7902240a2fbdfca018e45c48a3ab

SHA256
e0852494764bc6e85261593f458d43bdc8b0400393b8b670f6d2fbe199436cb9

SHA512
afad13ea9942ced8ccda98a7f6ca7c982a6b92f58df32f1fa01026cfb6e5afc0875783a43ce65242b53d25cd1916f3a090bd871992368cf5eae30919e9ed770e

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ratt.exe

Filesize
311.2MB

MD5
f83d98242d2ff376efe103f05c521a52

SHA1
9131d9affa2701f3c6a8d5883e70aa7f0db2906c

SHA256
89a3f7c8f7ab45164854a52b46367a1bc2dc6a8f4385d8edf1cec096107ff0eb

SHA512
c9124e601f53be01323f07a013339a4c53356ec3d5b232da9ae407076839177330568201c12026665721b2fcf9d3b4ebd0af0aa26d01007723fa4ede73ba1181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
0f5cbdca905beb13bebdcf43fb0716bd

SHA1
9e136131389fde83297267faf6c651d420671b3f

SHA256
a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

SHA512
a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ratt.exe.log

Filesize
1KB

MD5
9e104e9aa0cfdec0753de24cbe3f587b

SHA1
f63b8d0b29c65e518be6a9412e7499c9de11be78

SHA256
59a9f13de0e003ea4adcd0193477f147b0c91ae847eebc744e91a4efe167223f

SHA512
8253854159ceac2d84eb371c9672730831505dea52ac3bc2cca45ee5308717ca3f11734602d0a409974b137084a8c20e6b7653640991e45708f692c65ac4933b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
0b2bd127b7be68204cd2ce98b496cb65

SHA1
1cc022a31c433740d03daf17589c6fbf4b7f6128

SHA256
abba4d2c81dff63ef36aad53da1ab60b1a76d8c2f9fbed61e4381314cef11c3e

SHA512
5041542940e312bd6a98ea3be047375ccae91829e0206600c9cb9a37bd8a44b5f62d2e84790b589e0c875b574749965ff6991d2d8a3217394216b95f6c237cfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
db912ab2a5600ab53ed45b1c9f0407b2

SHA1
9d671b0bc3dcfcaeb05c461fa4fef1541a6b77c9

SHA256
4eeaee43898f220bc7052e082a9afb339e557fa2850faa9ab352fe05421b5c4a

SHA512
d133db58a4c7bd23afbb6c3db1a25ed769578bf3f073dbeef4d35d00efabd5d3baa91be39322879c3625029f8c1e3a8b16ff8222793fd9cff803ef7d42d6ac2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
31dffae56eb33ccb5ca62b89471117b3

SHA1
7f5a90cb4b4667817f3fd13b80799c5626c4c82d

SHA256
c0241f0fde5e7d6ece6d908d5c6c5389abd9f953af256aebef21ac1f888107b0

SHA512
c2726f3ffef0fc2a329ff7b84249399e6c2fd81892462de10d858783a185ce59c2aaa57b4472605f17b70f7097f3f2a1970c130e02e52abfb7846bcbbf85c8ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
12be97d1e264da6fd5b2305293474028

SHA1
4821600a91bfff9158d149ecc21855d2645105af

SHA256
a4d6d883c88087b6dde50bc110eed02863f52b88a136403176aaf1289be7ca70

SHA512
74d4553e86adadda672e30753023c8018be254b7cb3af50ccbb4270031337208373f68cbf9ed9a8e32ba383cd731bf5d846e04b49bc8695d6b88867bdb7a955f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
12KB

MD5
39348d65d6d4df9cf850784e6bc61723

SHA1
d0524332bb6f6b8f71f833f1560fd7e377edabbf

SHA256
ef55ca5f3ff025670469217782fe9c4509427f7616cb2f5d7fc08ae4d2fcc7c1

SHA512
38a649b7e06ed50367455f83ba5d2a0aad913600f14c0893b06b4a2a830ef280a7c153f7c304aa5a976e8e0dbc96d0175fd02fa9e82895c4f15b961b0d69e75b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z.exe

Filesize
71KB

MD5
8ba2e41b330ae9356e62eb63514cf82e

SHA1
8dc266467a5a0d587ed0181d4344581ef4ff30b2

SHA256
ea2ad8d87b79c8eb3952498c7005a195986436cfd7ca7736dbbdda979142daea

SHA512
2fdfc2d368c70320b3dac00fef06381ef90a2a82a1f3137109b033d84e5b70185039af6ec918012dc03bc9d046cd8d8aee3247ba0f59d394e78f1f73380f7a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Add.ps1

Filesize
1KB

MD5
0df43097e0f0acd04d9e17fb43d618b9

SHA1
69b3ade12cb228393a93624e65f41604a17c83b6

SHA256
c8e4a63337a25f55f75ad10ab2b420d716bad4b35a2044fd39dcd5936419d873

SHA512
01ae71dd2ee040baad6f4b9afcfbaeca2b9f6cc7d60ade5de637238d65c17d74292734666f4ae6b533f6bf1007c46387d8e690d97c3b7a535bcd6f216e70c4fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_00q5m0b3.myq.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.7z

Filesize
693KB

MD5
7de6fdf3629c73bf0c29a96fa23ae055

SHA1
dcb37f6d43977601c6460b17387a89b9e4c0609a

SHA256
069979bfb2aefe3cac239fe4f2477672eb75b90c9853fb67b2ac1438f2ec44ff

SHA512
d1ef2299aacf429572fd6df185009960e601e49126f080fdced26ec407e5db86eaa902e474635464aac146b7de286667a398f2c5e46c4a821dad2579bfb3acf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.bat

Filesize
1KB

MD5
7ea1fec84d76294d9256ae3dca7676b2

SHA1
1e335451d1cbb6951bc77bf75430f4d983491342

SHA256
9a419095c0bafc6b550f3f760c7b4f91ef3a956cfa6403d3750164ecdbe35940

SHA512
ab712c45081b3d1c7edd03e67a8db1518a546f3fbf00e99838dfe03a689c4867a6953e6603dcd2be458b2441f4a2b70286fd7d096549cfcf032dd2cd54d68317

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
664.6MB

MD5
3a327f4410ea142b575516d16d35f050

SHA1
84fb2c914b0694dc131247a586dfeb6ba325b9a4

SHA256
8d8c5082cc9684279168e52f3117e750fed5bfb1a295cb10d50e1f565f9bff19

SHA512
c2c91ebc3bb047e49b2e5e53fa5eb7076b125e343244474c91e3a52cba9593e75635ca23f84af505c5121540169d5f439e2452d56e044a4f485648c1553600c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratt.exe

Filesize
241.4MB

MD5
84b9719a1bac83c367168500aebbc40d

SHA1
9da9c8d1481b1a1c4edaa2c2fc64c59089b0eb2e

SHA256
912828efd420900e4c10e3b4c040b70b0fe9979962865d7bbe54b93fd42caa4a

SHA512
bf8bace87385786c0e13caaf715a3eaf7b9443821a3a3c6da64cb40b07d1ca46829bb9bc5d0d885e9694a06b9d6defb34f44ba726cc60f6f263eccb32fa10cf9

Download Submit
C:\Users\Admin\Music\rot.exe

Filesize
117.6MB

MD5
517c3f8e292993b1369092558d0118e9

SHA1
e4040303923d328d889a14dd73a1af2436bd4345

SHA256
ac2f07f6958e689630f7c1769cee8827dc9a84e26b152f71698e21a56bb86459

SHA512
afd228f69a111251cfb38260d97ee5203543ac88c4c6deeabe687e19a252ac7bfc9f4c39dd8fc70fde7fbbeb452649ba27441242fc72ca27dc0a0a5f91e356dc

Download Submit
\Users\Admin\AppData\Local\Temp\7z.dll

Filesize
328KB

MD5
15bbbe562f9be3e5dcbb834e635cc231

SHA1
7c01cf5fa4db2312c5ed2f7b8c41e3e5c346a51a

SHA256
ed50ef8e0b6dd83fb0c3f733329d4aa6e5a3beb3491e2ba9d2ae206813508dde

SHA512
769287951b8c16f4b10c1b58e82612844babe7b5c10445fe848d713fb5e8321bcbbd9780e9c564cffe35ea4144e8a7e19645291c4eea372fcaa19ae395a97287

Download Submit
memory/216-65-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/216-63-0x0000000004980000-0x0000000004990000-memory.dmp

Filesize
64KB

Download
memory/216-61-0x0000000004980000-0x0000000004990000-memory.dmp

Filesize
64KB

Download
memory/216-49-0x0000000004980000-0x0000000004990000-memory.dmp

Filesize
64KB

Download
memory/216-48-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/4176-103-0x0000000006D90000-0x0000000006DA0000-memory.dmp

Filesize
64KB

Download
memory/4176-89-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/4176-90-0x0000000006D90000-0x0000000006DA0000-memory.dmp

Filesize
64KB

Download
memory/4176-105-0x0000000006D90000-0x0000000006DA0000-memory.dmp

Filesize
64KB

Download
memory/4176-107-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/4440-69-0x0000000000E60000-0x0000000000E70000-memory.dmp

Filesize
64KB

Download
memory/4440-83-0x0000000000E60000-0x0000000000E70000-memory.dmp

Filesize
64KB

Download
memory/4440-71-0x0000000007410000-0x0000000007760000-memory.dmp

Filesize
3.3MB

Download
memory/4440-106-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/4440-86-0x0000000000E60000-0x0000000000E70000-memory.dmp

Filesize
64KB

Download
memory/4440-68-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/4440-70-0x0000000000E60000-0x0000000000E70000-memory.dmp

Filesize
64KB

Download
memory/4504-110-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/4504-124-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/4504-127-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/4504-123-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/4504-111-0x00000000030C0000-0x00000000030D0000-memory.dmp

Filesize
64KB

Download
memory/4768-390-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/4768-237-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/4768-182-0x0000000009C30000-0x0000000009CC4000-memory.dmp

Filesize
592KB

Download
memory/4768-181-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/4768-376-0x0000000009810000-0x000000000982A000-memory.dmp

Filesize
104KB

Download
memory/4768-381-0x0000000009800000-0x0000000009808000-memory.dmp

Filesize
32KB

Download
memory/4768-178-0x0000000009AE0000-0x0000000009B85000-memory.dmp

Filesize
660KB

Download
memory/4768-180-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/4768-407-0x000000000A4D0000-0x000000000AB48000-memory.dmp

Filesize
6.5MB

Download
memory/4768-179-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/4768-408-0x0000000009B90000-0x0000000009BAA000-memory.dmp

Filesize
104KB

Download
memory/4768-144-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/4768-146-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/4768-145-0x0000000004D70000-0x0000000004D80000-memory.dmp

Filesize
64KB

Download
memory/4768-147-0x0000000008180000-0x00000000084D0000-memory.dmp

Filesize
3.3MB

Download
memory/4768-414-0x0000000009CD0000-0x0000000009CF2000-memory.dmp

Filesize
136KB

Download
memory/4768-149-0x00000000089C0000-0x0000000008A0B000-memory.dmp

Filesize
300KB

Download
memory/4768-415-0x000000000AB50000-0x000000000B04E000-memory.dmp

Filesize
5.0MB

Download
memory/4768-171-0x000000007EBD0000-0x000000007EBE0000-memory.dmp

Filesize
64KB

Download
memory/4768-172-0x0000000009A50000-0x0000000009A83000-memory.dmp

Filesize
204KB

Download
memory/4768-173-0x0000000008A60000-0x0000000008A7E000-memory.dmp

Filesize
120KB

Download
memory/4888-39-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/4888-24-0x0000000008060000-0x00000000080C6000-memory.dmp

Filesize
408KB

Download
memory/4888-17-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/4888-18-0x0000000004FC0000-0x0000000004FF6000-memory.dmp

Filesize
216KB

Download
memory/4888-44-0x0000000073B10000-0x00000000741FE000-memory.dmp

Filesize
6.9MB

Download
memory/4888-40-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/4888-28-0x0000000008820000-0x0000000008896000-memory.dmp

Filesize
472KB

Download
memory/4888-27-0x00000000087D0000-0x000000000881B000-memory.dmp

Filesize
300KB

Download
memory/4888-26-0x0000000007F40000-0x0000000007F5C000-memory.dmp

Filesize
112KB

Download
memory/4888-25-0x00000000080F0000-0x0000000008440000-memory.dmp

Filesize
3.3MB

Download
memory/4888-23-0x0000000007E10000-0x0000000007E76000-memory.dmp

Filesize
408KB

Download
memory/4888-19-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/4888-22-0x0000000007610000-0x0000000007632000-memory.dmp

Filesize
136KB

Download
memory/4888-21-0x00000000076B0000-0x0000000007CD8000-memory.dmp

Filesize
6.2MB

Download
memory/4888-20-0x0000000005020000-0x0000000005030000-memory.dmp

Filesize
64KB

Download
memory/4976-482-0x0000000000A00000-0x0000000000AAE000-memory.dmp

Filesize
696KB

Download
memory/4984-446-0x0000000073A40000-0x000000007412E000-memory.dmp

Filesize
6.9MB

Download
memory/4984-447-0x0000000000C80000-0x0000000000E36000-memory.dmp

Filesize
1.7MB

Download
memory/4984-448-0x0000000004BB0000-0x0000000004C4C000-memory.dmp

Filesize
624KB

Download
memory/4984-449-0x0000000004C50000-0x0000000004CE2000-memory.dmp

Filesize
584KB

Download
memory/5028-138-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5028-130-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5028-134-0x0000000010000000-0x00000000100E2000-memory.dmp

Filesize
904KB

Download