604a60be7c541d08efda9f53a37e8bcaa40703b8fc384e5b87dda24fae721d29

Analysis

max time kernel
156s
max time network
167s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
15/10/2023, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
Size

585KB
MD5

1843b7445a84689e45962d5a2f7239a0
SHA1

d2e62464eac5b43c701b1a48bf09a01b7c565dd1
SHA256

604a60be7c541d08efda9f53a37e8bcaa40703b8fc384e5b87dda24fae721d29
SHA512

d7252a2cc52009651b5d27430854c06f63dab69d476cd20d909d0674d591f52772e65464bd56618ede0974dfe090b6264031ff2bc61093559f612e21e1030805
SSDEEP

6144:NeHwXUU5EYCTvaBjRjWrLJKuKnGML5Njcxmu3ijWrLJKuKnGML5Njcxgu3hjWrLA:NyMUusvalgg5Njam8g5Njagxg5Njag5

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\RXG5H8S\\DSC8L5S.exe\""	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, \"C:\\Windows\\RXG5H8S\\DSC8L5S.exe\""	lsass.exe

Modifies visibility of file extensions in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	lsass.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	system.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	system.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	lsass.exe

Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490

Sets file execution options in registry 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\RXG5H8S\\regedit.cmd"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\debugger = "C:\\Windows\\notepad.exe"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\debugger = "C:\\Windows\\RXG5H8S\\regedit.cmd"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	lsass.exe

Executes dropped EXE 4 IoCs

pid	Process
2444	service.exe
2520	smss.exe
1068	system.exe
1764	lsass.exe

Loads dropped DLL 5 IoCs

pid	Process
3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0034000000016c2b-74.dat	upx
behavioral1/files/0x0034000000016c2b-82.dat	upx
behavioral1/files/0x0034000000016c2b-145.dat	upx
behavioral1/files/0x0034000000016c2b-180.dat	upx
behavioral1/memory/1068-184-0x0000000010000000-0x0000000010075000-memory.dmp	upx
behavioral1/files/0x0034000000016c2b-196.dat	upx

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\sXG0Q2W0 = "C:\\Windows\\system32\\FXW5G1YCGP3L3J.exe"	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\0L5SGP = "C:\\Windows\\TWJ0Q2W.exe"	system.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\sXG0Q2W0 = "C:\\Windows\\system32\\FXW5G1YCGP3L3J.exe"	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RUN\0L5SGP = "C:\\Windows\\TWJ0Q2W.exe"	lsass.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	service.exe
File opened (read-only)	\??\I:	service.exe
File opened (read-only)	\??\J:	service.exe
File opened (read-only)	\??\N:	service.exe
File opened (read-only)	\??\S:	service.exe
File opened (read-only)	\??\Y:	service.exe
File opened (read-only)	\??\E:	service.exe
File opened (read-only)	\??\G:	service.exe
File opened (read-only)	\??\K:	service.exe
File opened (read-only)	\??\M:	service.exe
File opened (read-only)	\??\T:	service.exe
File opened (read-only)	\??\V:	service.exe
File opened (read-only)	\??\W:	service.exe
File opened (read-only)	\??\Z:	service.exe
File opened (read-only)	\??\L:	service.exe
File opened (read-only)	\??\O:	service.exe
File opened (read-only)	\??\P:	service.exe
File opened (read-only)	\??\R:	service.exe
File opened (read-only)	\??\H:	service.exe
File opened (read-only)	\??\Q:	service.exe
File opened (read-only)	\??\U:	service.exe

Drops file in System32 directory 35 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UMO0R1D	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\UMO0R1D\FXW5G1Y.cmd	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\FXW5G1YCGP3L3J.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\FXW5G1YCGP3L3J.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\KJM8S7F.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\KJM8S7F.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\KJM8S7F.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\FXW5G1YCGP3L3J.exe	service.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	service.exe
File opened for modification	C:\Windows\SysWOW64\UMO0R1D	lsass.exe
File opened for modification	C:\Windows\SysWOW64\FXW5G1YCGP3L3J.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\KJM8S7F.exe	lsass.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	smss.exe
File opened for modification	C:\Windows\SysWOW64\UMO0R1D\FXW5G1Y.cmd	smss.exe
File opened for modification	C:\Windows\SysWOW64\FXW5G1YCGP3L3J.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\UMO0R1D	service.exe
File opened for modification	C:\Windows\SysWOW64\KJM8S7F.exe	system.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\SysWOW64\UMO0R1D\FXW5G1Y.cmd	lsass.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\SysWOW64\UMO0R1D\FXW5G1Y.cmd	system.exe
File opened for modification	C:\Windows\SysWOW64\UMO0R1D\FXW5G1Y.cmd	service.exe
File opened for modification	C:\Windows\SysWOW64\UMO0R1D	system.exe
File opened for modification	C:\Windows\SysWOW64\UMO0R1D	smss.exe
File opened for modification	C:\Windows\SysWOW64\regedit.exe	smss.exe
File opened for modification	C:\Windows\SysWOW64\systear.dll	lsass.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\RXG5H8S\service.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\cypreg.dll	smss.exe
File opened for modification	C:\Windows\RXG5H8S\QTQ0U7N.com	smss.exe
File opened for modification	C:\Windows\moonlight.dll	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\RXG5H8S\service.exe	smss.exe
File opened for modification	C:\Windows\CGP3L3J.exe	smss.exe
File created	C:\Windows\MooNlight.txt	smss.exe
File opened for modification	C:\Windows\RXG5H8S\smss.exe	lsass.exe
File opened for modification	C:\Windows\RXG5H8S\system.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\cypreg.dll	service.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	smss.exe
File opened for modification	C:\Windows\RXG5H8S\regedit.cmd	service.exe
File opened for modification	C:\Windows\cypreg.dll	system.exe
File opened for modification	C:\Windows\64enc.en	system.exe
File opened for modification	C:\Windows\RXG5H8S\winlogon.exe	lsass.exe
File opened for modification	C:\Windows\RXG5H8S\regedit.cmd	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\RXG5H8S	service.exe
File opened for modification	C:\Windows\RXG5H8S\DSC8L5S.exe	smss.exe
File opened for modification	C:\Windows\RXG5H8S\smss.exe	service.exe
File opened for modification	C:\Windows\RXG5H8S\system.exe	system.exe
File opened for modification	C:\Windows\TWJ0Q2W.exe	lsass.exe
File opened for modification	C:\Windows\lsass.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\TWJ0Q2W.exe	service.exe
File opened for modification	C:\Windows\RXG5H8S\DSC8L5S.exe	service.exe
File opened for modification	C:\Windows\RXG5H8S\service.exe	system.exe
File opened for modification	C:\Windows\RXG5H8S	lsass.exe
File opened for modification	C:\Windows\lsass.exe	lsass.exe
File opened for modification	C:\Windows\moonlight.dll	service.exe
File opened for modification	C:\Windows\RXG5H8S\smss.exe	system.exe
File opened for modification	C:\Windows\RXG5H8S\QTQ0U7N.com	system.exe
File opened for modification	C:\Windows\cypreg.dll	lsass.exe
File opened for modification	C:\Windows\RXG5H8S\system.exe	smss.exe
File opened for modification	C:\Windows\TWJ0Q2W.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\RXG5H8S\DSC8L5S.exe	system.exe
File opened for modification	C:\Windows\RXG5H8S\winlogon.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\RXG5H8S\DSC8L5S.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\CGP3L3J.exe	lsass.exe
File opened for modification	C:\Windows\RXG5H8S	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\lsass.exe	service.exe
File opened for modification	C:\Windows\lsass.exe	smss.exe
File opened for modification	C:\Windows\onceinabluemoon.mid	service.exe
File opened for modification	C:\Windows\RXG5H8S\service.exe	service.exe
File opened for modification	C:\Windows\TWJ0Q2W.exe	smss.exe
File opened for modification	C:\Windows\CGP3L3J.exe	system.exe
File opened for modification	C:\Windows\RXG5H8S\DSC8L5S.exe	lsass.exe
File opened for modification	C:\Windows\RXG5H8S\QTQ0U7N.com	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\CGP3L3J.exe	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\RXG5H8S\winlogon.exe	service.exe
File opened for modification	C:\Windows\moonlight.dll	smss.exe
File opened for modification	C:\Windows\RXG5H8S\smss.exe	smss.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	system.exe
File opened for modification	C:\Windows\RXG5H8S\winlogon.exe	system.exe
File opened for modification	C:\Windows\RXG5H8S\regedit.cmd	system.exe
File opened for modification	C:\Windows\cypreg.dll	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
File opened for modification	C:\Windows\system\msvbvm60.dll	lsass.exe
File opened for modification	C:\Windows\moonlight.dll	lsass.exe
File opened for modification	C:\Windows\TWJ0Q2W.exe	system.exe
File opened for modification	C:\Windows\RXG5H8S\system.exe	service.exe
File opened for modification	C:\Windows\CGP3L3J.exe	service.exe
File opened for modification	C:\Windows\RXG5H8S\QTQ0U7N.com	service.exe
File opened for modification	C:\Windows\RXG5H8S\QTQ0U7N.com	lsass.exe
File opened for modification	C:\Windows\RXG5H8S\regedit.cmd	smss.exe
File opened for modification	C:\Windows\RXG5H8S\system.exe	lsass.exe
File opened for modification	C:\Windows\RXG5H8S	system.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	lsass.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder"	system.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile	lsass.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\ = "File Folder"	lsass.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
2444	service.exe
2520	smss.exe
1068	system.exe
1764	lsass.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2444	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	28
PID 3028 wrote to memory of 2444	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	28
PID 3028 wrote to memory of 2444	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	28
PID 3028 wrote to memory of 2444	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	28
PID 3028 wrote to memory of 2520	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	29
PID 3028 wrote to memory of 2520	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	29
PID 3028 wrote to memory of 2520	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	29
PID 3028 wrote to memory of 2520	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	29
PID 3028 wrote to memory of 1068	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	30
PID 3028 wrote to memory of 1068	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	30
PID 3028 wrote to memory of 1068	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	30
PID 3028 wrote to memory of 1068	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	30
PID 3028 wrote to memory of 1764	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	33
PID 3028 wrote to memory of 1764	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	33
PID 3028 wrote to memory of 1764	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	33
PID 3028 wrote to memory of 1764	3028	1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe	33

C:\Users\Admin\AppData\Local\Temp\1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe
"C:\Users\Admin\AppData\Local\Temp\1843b7445a84689e45962d5a2f7239a0_exe32_JC.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\RXG5H8S\service.exe
  "C:\Windows\RXG5H8S\service.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2444
- C:\Windows\RXG5H8S\smss.exe
  "C:\Windows\RXG5H8S\smss.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2520
- C:\Windows\RXG5H8S\system.exe
  "C:\Windows\RXG5H8S\system.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1068
- C:\Windows\lsass.exe
  "C:\Windows\lsass.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Sets file execution options in registry
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:1764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Videos\My Videos.exe

Filesize
585KB

MD5
e39be03b1e007add00c5aea814006cdb

SHA1
a7e0f841e5066a0cb6b3f822c01a92cab034a2ca

SHA256
1f45b089eb4c876c6b644c47685eac59b85b96d8ff4fa22a1ae7a6aebdae1c72

SHA512
97081e698db5da9b966437dd401dd05e3f425bbd2b213e591fae740e73268ac00a00395e6c6dacd8172048fc5d35976874fcd2e9ca2d7464e613f4a17a8f9014

Download Submit
C:\Windows\CGP3L3J.exe

Filesize
585KB

MD5
b214015892fab5c449e77729703f0895

SHA1
336354a487b8616ec3ac2211899d7370ffa87bea

SHA256
e61b9f1616aca159f671c69355a6100cf4326a006ebf35d0b3c0f2c685c0957f

SHA512
8429b7b67720a52d86bc596d1166118e86b0f8c971fd5064760cb68663d3af18de741037fbf9047fbdcdd3b8323ed8a8a1a65d6e43b7ff0bb7bc588dc726e0d0

Download Submit
C:\Windows\CGP3L3J.exe

Filesize
585KB

MD5
e7c3a92d8a96b2cb2695e80cc7e70477

SHA1
da33cde273581ee3847e6f608498b0f1ae95292c

SHA256
53f4e3a4d4333508995863c1ecec8f83cada47a8af934043555b03c5291da0f7

SHA512
31b81245a051719a29e5f21067a8c62eb0db6dac7c456c2fa8827ed22da8f5bd5669de1b6350da9db7a18c47c39417bcdbfdba021020c1cb01d028a35f1db026

Download Submit
C:\Windows\CGP3L3J.exe

Filesize
585KB

MD5
1843b7445a84689e45962d5a2f7239a0

SHA1
d2e62464eac5b43c701b1a48bf09a01b7c565dd1

SHA256
604a60be7c541d08efda9f53a37e8bcaa40703b8fc384e5b87dda24fae721d29

SHA512
d7252a2cc52009651b5d27430854c06f63dab69d476cd20d909d0674d591f52772e65464bd56618ede0974dfe090b6264031ff2bc61093559f612e21e1030805

Download Submit
C:\Windows\CGP3L3J.exe

Filesize
585KB

MD5
b214015892fab5c449e77729703f0895

SHA1
336354a487b8616ec3ac2211899d7370ffa87bea

SHA256
e61b9f1616aca159f671c69355a6100cf4326a006ebf35d0b3c0f2c685c0957f

SHA512
8429b7b67720a52d86bc596d1166118e86b0f8c971fd5064760cb68663d3af18de741037fbf9047fbdcdd3b8323ed8a8a1a65d6e43b7ff0bb7bc588dc726e0d0

Download Submit
C:\Windows\RXG5H8S\DSC8L5S.exe

Filesize
585KB

MD5
52efb551c35e5d7104b96f87f27504c2

SHA1
460f508e8c8f856bfd76f1e591659a726abcfd1e

SHA256
00839cd69d18ca994987de6c0ab37c96d5481e2949340068902f9d6a851da2a4

SHA512
ce2e12e58e34ab9452803a462b294743321d21dbe64dc055bb3609db0261060dd16c8aba628dbb59f235ed8cad716f80d22fb9e15c307f50d3ec5c52dd0b9832

Download Submit
C:\Windows\RXG5H8S\DSC8L5S.exe

Filesize
585KB

MD5
e39be03b1e007add00c5aea814006cdb

SHA1
a7e0f841e5066a0cb6b3f822c01a92cab034a2ca

SHA256
1f45b089eb4c876c6b644c47685eac59b85b96d8ff4fa22a1ae7a6aebdae1c72

SHA512
97081e698db5da9b966437dd401dd05e3f425bbd2b213e591fae740e73268ac00a00395e6c6dacd8172048fc5d35976874fcd2e9ca2d7464e613f4a17a8f9014

Download Submit
C:\Windows\RXG5H8S\QTQ0U7N.com

Filesize
585KB

MD5
db1a9ba46a8d0e0ae7206c4775fc854f

SHA1
79abefc4a062461c81f6f98f14793d4dec2ed900

SHA256
7bef696a90271773ccb7647c5eca1d2007d3db958c1b1b85d9305127cc2e9dc5

SHA512
b380339ff49a6ca30a6fb4f393287764c93bf16c78463cf3c6804abe3407b8efd22dfa97e387d69e6f0b9cfe94ba7883fd3ae2f3817326c2fa69a46856d0ed10

Download Submit
C:\Windows\RXG5H8S\QTQ0U7N.com

Filesize
585KB

MD5
def5ce02af0dbde77a5b68b16f1515d1

SHA1
bf43840af8f62c6e43c69bb62ed8e3865a8c3980

SHA256
4a76d74118d7043d401cfab284f2989e50cfabd3889c1faf0e67d40a0b6ba025

SHA512
381fed88273dd20c33af02fb1dc32c8a50f8bb353a9942336d3dfd1eec811c5c2bac44df0ab896a1b02fd0b3ca643263dedac9fa480a0110dbffb1d04642b7c9

Download Submit
C:\Windows\RXG5H8S\QTQ0U7N.com

Filesize
585KB

MD5
66e23a78a09337f0c1a2ce2b0de89ff7

SHA1
09c591946472054c13498031fb78fc291a9c3047

SHA256
5d7bfae4887e068ea8af77e2d3938a70976a41b2478dae829ae2b50c3b344f5e

SHA512
eef0c81bc93ed25be0469d61679cd13c66f538c22efb22c1da1e602081600b50e01e0d4482c7fe87c8fdfc347aab8c45beadde14a869e70395d044c708ac2635

Download Submit
C:\Windows\RXG5H8S\QTQ0U7N.com

Filesize
585KB

MD5
db1a9ba46a8d0e0ae7206c4775fc854f

SHA1
79abefc4a062461c81f6f98f14793d4dec2ed900

SHA256
7bef696a90271773ccb7647c5eca1d2007d3db958c1b1b85d9305127cc2e9dc5

SHA512
b380339ff49a6ca30a6fb4f393287764c93bf16c78463cf3c6804abe3407b8efd22dfa97e387d69e6f0b9cfe94ba7883fd3ae2f3817326c2fa69a46856d0ed10

Download Submit
C:\Windows\RXG5H8S\regedit.cmd

Filesize
585KB

MD5
b214015892fab5c449e77729703f0895

SHA1
336354a487b8616ec3ac2211899d7370ffa87bea

SHA256
e61b9f1616aca159f671c69355a6100cf4326a006ebf35d0b3c0f2c685c0957f

SHA512
8429b7b67720a52d86bc596d1166118e86b0f8c971fd5064760cb68663d3af18de741037fbf9047fbdcdd3b8323ed8a8a1a65d6e43b7ff0bb7bc588dc726e0d0

Download Submit
C:\Windows\RXG5H8S\regedit.cmd

Filesize
585KB

MD5
2fc98744385a39c832b89f8e7db30845

SHA1
9cf6722e092e7d9b8a8b41d85e0e2db39e8bea4c

SHA256
7d5a55640385cf4a16e2e59dc9541dcf179bc4f5f7dd8a1216aea25e3dedcc7f

SHA512
3febbae8dc3e25907dc583d1221985c470ac58714295b0ee856620106922c144b77136d2e2702686e63caeed8bd8e84f4a8af7fb12102425e6c0779e639d5629

Download Submit
C:\Windows\RXG5H8S\service.exe

Filesize
585KB

MD5
28fb4d1b02fba533dd858395655ba633

SHA1
db7e551d25af90a9a9d01885cc2b17ceecc6d473

SHA256
7e53a71dadba6860cfbae2423a0f6450c824dd66a4de32d9865a7ed6b1a550c1

SHA512
9afd81daf2c7c6a2de56d963998a43863434cd43b8b81128b84a9c5e64f4973993cfa46c86e5db43c6a4167515c5b101881a50a359d00fb0900f4c5340eb72a1

Download Submit
C:\Windows\RXG5H8S\service.exe

Filesize
585KB

MD5
28fb4d1b02fba533dd858395655ba633

SHA1
db7e551d25af90a9a9d01885cc2b17ceecc6d473

SHA256
7e53a71dadba6860cfbae2423a0f6450c824dd66a4de32d9865a7ed6b1a550c1

SHA512
9afd81daf2c7c6a2de56d963998a43863434cd43b8b81128b84a9c5e64f4973993cfa46c86e5db43c6a4167515c5b101881a50a359d00fb0900f4c5340eb72a1

Download Submit
C:\Windows\RXG5H8S\service.exe

Filesize
585KB

MD5
28fb4d1b02fba533dd858395655ba633

SHA1
db7e551d25af90a9a9d01885cc2b17ceecc6d473

SHA256
7e53a71dadba6860cfbae2423a0f6450c824dd66a4de32d9865a7ed6b1a550c1

SHA512
9afd81daf2c7c6a2de56d963998a43863434cd43b8b81128b84a9c5e64f4973993cfa46c86e5db43c6a4167515c5b101881a50a359d00fb0900f4c5340eb72a1

Download Submit
C:\Windows\RXG5H8S\smss.exe

Filesize
585KB

MD5
08b605e99c2933400c487afccf8d7b8d

SHA1
18d182cf05edfabf6262b709e7edcecb483e182d

SHA256
34916e191c5682e99133c6028b8d8bde90cfb527d62e31fff80766118d5eac08

SHA512
c309d5ef6ddc7d907a23f5ace7505b441d56989d74ea78d4af1b0847a3a235555ad4cc9e06b88e906043c24dd94f8fa35b0ab55520b8ef540243cae985efe0a6

Download Submit
C:\Windows\RXG5H8S\smss.exe

Filesize
585KB

MD5
08b605e99c2933400c487afccf8d7b8d

SHA1
18d182cf05edfabf6262b709e7edcecb483e182d

SHA256
34916e191c5682e99133c6028b8d8bde90cfb527d62e31fff80766118d5eac08

SHA512
c309d5ef6ddc7d907a23f5ace7505b441d56989d74ea78d4af1b0847a3a235555ad4cc9e06b88e906043c24dd94f8fa35b0ab55520b8ef540243cae985efe0a6

Download Submit
C:\Windows\RXG5H8S\smss.exe

Filesize
585KB

MD5
08b605e99c2933400c487afccf8d7b8d

SHA1
18d182cf05edfabf6262b709e7edcecb483e182d

SHA256
34916e191c5682e99133c6028b8d8bde90cfb527d62e31fff80766118d5eac08

SHA512
c309d5ef6ddc7d907a23f5ace7505b441d56989d74ea78d4af1b0847a3a235555ad4cc9e06b88e906043c24dd94f8fa35b0ab55520b8ef540243cae985efe0a6

Download Submit
C:\Windows\RXG5H8S\system.exe

Filesize
585KB

MD5
08b605e99c2933400c487afccf8d7b8d

SHA1
18d182cf05edfabf6262b709e7edcecb483e182d

SHA256
34916e191c5682e99133c6028b8d8bde90cfb527d62e31fff80766118d5eac08

SHA512
c309d5ef6ddc7d907a23f5ace7505b441d56989d74ea78d4af1b0847a3a235555ad4cc9e06b88e906043c24dd94f8fa35b0ab55520b8ef540243cae985efe0a6

Download Submit
C:\Windows\RXG5H8S\system.exe

Filesize
585KB

MD5
08b605e99c2933400c487afccf8d7b8d

SHA1
18d182cf05edfabf6262b709e7edcecb483e182d

SHA256
34916e191c5682e99133c6028b8d8bde90cfb527d62e31fff80766118d5eac08

SHA512
c309d5ef6ddc7d907a23f5ace7505b441d56989d74ea78d4af1b0847a3a235555ad4cc9e06b88e906043c24dd94f8fa35b0ab55520b8ef540243cae985efe0a6

Download Submit
C:\Windows\RXG5H8S\winlogon.exe

Filesize
585KB

MD5
957c1d38d58cdcd46c7db3e60cf4b322

SHA1
09f773e91acc88594fadc0137159412d01329288

SHA256
3f025a67d24604db9f356da84db0321a973d5f33d58aac8cc0a11a8610063d8f

SHA512
3ec07e6c17cb883cf64b2f03f9b962a4899fcee1574f7b4c5e858ee812f43e5224133681257c037b62bde0d9e77bfa98e1b62bcc49a073154fbb96723816ceff

Download Submit
C:\Windows\RXG5H8S\winlogon.exe

Filesize
585KB

MD5
ca08ac07ad9a743520a3fedb5e167cd4

SHA1
33720ca68a06a303d0aca9f197c837d1a78b2893

SHA256
4679314fa23a9490f462323ba783228b0a7179fdc362cb7eb435dc67bafbf4f6

SHA512
848e8c5c042f61f2ff3ac812a00f9e65e8eaa5d6c68edd0eb366c0c32cee877044742a38f15280544398ae23ae7b67ca53a0ec63038e64c47a74b0c353348289

Download Submit
C:\Windows\SysWOW64\FXW5G1YCGP3L3J.exe

Filesize
585KB

MD5
52efb551c35e5d7104b96f87f27504c2

SHA1
460f508e8c8f856bfd76f1e591659a726abcfd1e

SHA256
00839cd69d18ca994987de6c0ab37c96d5481e2949340068902f9d6a851da2a4

SHA512
ce2e12e58e34ab9452803a462b294743321d21dbe64dc055bb3609db0261060dd16c8aba628dbb59f235ed8cad716f80d22fb9e15c307f50d3ec5c52dd0b9832

Download Submit
C:\Windows\SysWOW64\FXW5G1YCGP3L3J.exe

Filesize
585KB

MD5
52efb551c35e5d7104b96f87f27504c2

SHA1
460f508e8c8f856bfd76f1e591659a726abcfd1e

SHA256
00839cd69d18ca994987de6c0ab37c96d5481e2949340068902f9d6a851da2a4

SHA512
ce2e12e58e34ab9452803a462b294743321d21dbe64dc055bb3609db0261060dd16c8aba628dbb59f235ed8cad716f80d22fb9e15c307f50d3ec5c52dd0b9832

Download Submit
C:\Windows\SysWOW64\FXW5G1YCGP3L3J.exe

Filesize
585KB

MD5
2aa26db0d444140bbd7eeaebf64d0423

SHA1
dbff1b5fd1ebd82b07bb274339b9baa331f35f43

SHA256
114140b24bf1b3a0a834e8af06f2447d8f14afb7869a149eac0ec1e936c24474

SHA512
8ee5375aec714d775bf8d4902c42ba38115cfbd495ae955c5fb82775e45a5f97504b0464d2f44d326f9b5d566deac2afec53a16c3089b58b3f24097884fcac78

Download Submit
C:\Windows\SysWOW64\FXW5G1YCGP3L3J.exe

Filesize
585KB

MD5
ed4f77b85d0d69a6741e378943a9d1bd

SHA1
f98b97066636f6a5f62f5da0d97058f110193a48

SHA256
e406af07e2fe0880a7ce212f2d9c0e163103a8725f5710408dccbcad98833696

SHA512
67d71e6979232407ae08b41248e4c603b5c178e2b094fb9c919a874be3c02edb64442b2feee8c0e806cdf8e29ae233cd0cf29acb5ffeda6148488e3269426c0b

Download Submit
C:\Windows\SysWOW64\FXW5G1YCGP3L3J.exe

Filesize
585KB

MD5
ed4f77b85d0d69a6741e378943a9d1bd

SHA1
f98b97066636f6a5f62f5da0d97058f110193a48

SHA256
e406af07e2fe0880a7ce212f2d9c0e163103a8725f5710408dccbcad98833696

SHA512
67d71e6979232407ae08b41248e4c603b5c178e2b094fb9c919a874be3c02edb64442b2feee8c0e806cdf8e29ae233cd0cf29acb5ffeda6148488e3269426c0b

Download Submit
C:\Windows\SysWOW64\KJM8S7F.exe

Filesize
585KB

MD5
28fb4d1b02fba533dd858395655ba633

SHA1
db7e551d25af90a9a9d01885cc2b17ceecc6d473

SHA256
7e53a71dadba6860cfbae2423a0f6450c824dd66a4de32d9865a7ed6b1a550c1

SHA512
9afd81daf2c7c6a2de56d963998a43863434cd43b8b81128b84a9c5e64f4973993cfa46c86e5db43c6a4167515c5b101881a50a359d00fb0900f4c5340eb72a1

Download Submit
C:\Windows\SysWOW64\KJM8S7F.exe

Filesize
585KB

MD5
28fb4d1b02fba533dd858395655ba633

SHA1
db7e551d25af90a9a9d01885cc2b17ceecc6d473

SHA256
7e53a71dadba6860cfbae2423a0f6450c824dd66a4de32d9865a7ed6b1a550c1

SHA512
9afd81daf2c7c6a2de56d963998a43863434cd43b8b81128b84a9c5e64f4973993cfa46c86e5db43c6a4167515c5b101881a50a359d00fb0900f4c5340eb72a1

Download Submit
C:\Windows\SysWOW64\KJM8S7F.exe

Filesize
585KB

MD5
c2ab4d9e272d775bd9c85e6aef9631d3

SHA1
1c504e802a8c9473f0cba2ad809e7bf9900042f4

SHA256
9e59ec40562353499b836ae6f26eacea9600b7b9b13f3e437d888cd1fc461277

SHA512
95a34e76bcbf9d11953c302076e00837ecd896596c518085fa964f312289a0b35750cf28b268a9c414e574f8f04dfc1b4793a3c97246bbb57a4c188a3bd492d7

Download Submit
C:\Windows\SysWOW64\KJM8S7F.exe

Filesize
585KB

MD5
c2ab4d9e272d775bd9c85e6aef9631d3

SHA1
1c504e802a8c9473f0cba2ad809e7bf9900042f4

SHA256
9e59ec40562353499b836ae6f26eacea9600b7b9b13f3e437d888cd1fc461277

SHA512
95a34e76bcbf9d11953c302076e00837ecd896596c518085fa964f312289a0b35750cf28b268a9c414e574f8f04dfc1b4793a3c97246bbb57a4c188a3bd492d7

Download Submit
C:\Windows\SysWOW64\KJM8S7F.exe

Filesize
585KB

MD5
28fb4d1b02fba533dd858395655ba633

SHA1
db7e551d25af90a9a9d01885cc2b17ceecc6d473

SHA256
7e53a71dadba6860cfbae2423a0f6450c824dd66a4de32d9865a7ed6b1a550c1

SHA512
9afd81daf2c7c6a2de56d963998a43863434cd43b8b81128b84a9c5e64f4973993cfa46c86e5db43c6a4167515c5b101881a50a359d00fb0900f4c5340eb72a1

Download Submit
C:\Windows\SysWOW64\UMO0R1D\FXW5G1Y.cmd

Filesize
585KB

MD5
5ce52217197df47202ab871a1362c8a0

SHA1
e9e398fde0420b2594bf0aa2ec0d9f77d1b24245

SHA256
5f974794af6b0421defb25958cefb4003329ab7dd9c129d0fdc7a7c476da1fd9

SHA512
0a004617e6028d14fc25c2342b092d9e2882367f964f3062f114da21ea8bcb6b8ab23ae0818c14d412a88d2d0623f6c186166b97de40645d02e816e0eb3fd7d3

Download Submit
C:\Windows\SysWOW64\UMO0R1D\FXW5G1Y.cmd

Filesize
585KB

MD5
52efb551c35e5d7104b96f87f27504c2

SHA1
460f508e8c8f856bfd76f1e591659a726abcfd1e

SHA256
00839cd69d18ca994987de6c0ab37c96d5481e2949340068902f9d6a851da2a4

SHA512
ce2e12e58e34ab9452803a462b294743321d21dbe64dc055bb3609db0261060dd16c8aba628dbb59f235ed8cad716f80d22fb9e15c307f50d3ec5c52dd0b9832

Download Submit
C:\Windows\SysWOW64\UMO0R1D\FXW5G1Y.cmd

Filesize
585KB

MD5
52efb551c35e5d7104b96f87f27504c2

SHA1
460f508e8c8f856bfd76f1e591659a726abcfd1e

SHA256
00839cd69d18ca994987de6c0ab37c96d5481e2949340068902f9d6a851da2a4

SHA512
ce2e12e58e34ab9452803a462b294743321d21dbe64dc055bb3609db0261060dd16c8aba628dbb59f235ed8cad716f80d22fb9e15c307f50d3ec5c52dd0b9832

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
dfbfe065bd316788c690807b061a7c35

SHA1
602ffbb18f6a5de0d4e81e51d78ca5fd4901f35e

SHA256
212b8c29854bff58ebe4c3792181660b15b590040aaeb35632b29adff46a431b

SHA512
af634dcce70ebcbe1a675329f072b5428b4fc8de156ab048588c37ed2b3f7dedd5641cad8658a9a01d61faaaa33656ec3ed3c6ab847137c29600ec985c2e01e5

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
dfbfe065bd316788c690807b061a7c35

SHA1
602ffbb18f6a5de0d4e81e51d78ca5fd4901f35e

SHA256
212b8c29854bff58ebe4c3792181660b15b590040aaeb35632b29adff46a431b

SHA512
af634dcce70ebcbe1a675329f072b5428b4fc8de156ab048588c37ed2b3f7dedd5641cad8658a9a01d61faaaa33656ec3ed3c6ab847137c29600ec985c2e01e5

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
dfbfe065bd316788c690807b061a7c35

SHA1
602ffbb18f6a5de0d4e81e51d78ca5fd4901f35e

SHA256
212b8c29854bff58ebe4c3792181660b15b590040aaeb35632b29adff46a431b

SHA512
af634dcce70ebcbe1a675329f072b5428b4fc8de156ab048588c37ed2b3f7dedd5641cad8658a9a01d61faaaa33656ec3ed3c6ab847137c29600ec985c2e01e5

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
dfbfe065bd316788c690807b061a7c35

SHA1
602ffbb18f6a5de0d4e81e51d78ca5fd4901f35e

SHA256
212b8c29854bff58ebe4c3792181660b15b590040aaeb35632b29adff46a431b

SHA512
af634dcce70ebcbe1a675329f072b5428b4fc8de156ab048588c37ed2b3f7dedd5641cad8658a9a01d61faaaa33656ec3ed3c6ab847137c29600ec985c2e01e5

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
141B

MD5
dfbfe065bd316788c690807b061a7c35

SHA1
602ffbb18f6a5de0d4e81e51d78ca5fd4901f35e

SHA256
212b8c29854bff58ebe4c3792181660b15b590040aaeb35632b29adff46a431b

SHA512
af634dcce70ebcbe1a675329f072b5428b4fc8de156ab048588c37ed2b3f7dedd5641cad8658a9a01d61faaaa33656ec3ed3c6ab847137c29600ec985c2e01e5

Download Submit
C:\Windows\SysWOW64\systear.dll

Filesize
127B

MD5
9c494650eaaa919a894e66ef4e02b4b1

SHA1
07f3c2cf1ab277d9d151ca15ca3815a6368a4c8b

SHA256
d9da21f8bc3e909fb79d9f16a819212c173907f5ab8e65d0f34df329a681e5dc

SHA512
e5d0c029effc0b3a47f66665c2a4a12bf085ebc7a68a9b877798e4e6f4e6e027bbdd8e58672a9b86d6548717aabd40579b35736deb82ded8407d0f8a56831457

Download Submit
C:\Windows\TWJ0Q2W.exe

Filesize
585KB

MD5
e39be03b1e007add00c5aea814006cdb

SHA1
a7e0f841e5066a0cb6b3f822c01a92cab034a2ca

SHA256
1f45b089eb4c876c6b644c47685eac59b85b96d8ff4fa22a1ae7a6aebdae1c72

SHA512
97081e698db5da9b966437dd401dd05e3f425bbd2b213e591fae740e73268ac00a00395e6c6dacd8172048fc5d35976874fcd2e9ca2d7464e613f4a17a8f9014

Download Submit
C:\Windows\TWJ0Q2W.exe

Filesize
585KB

MD5
1843b7445a84689e45962d5a2f7239a0

SHA1
d2e62464eac5b43c701b1a48bf09a01b7c565dd1

SHA256
604a60be7c541d08efda9f53a37e8bcaa40703b8fc384e5b87dda24fae721d29

SHA512
d7252a2cc52009651b5d27430854c06f63dab69d476cd20d909d0674d591f52772e65464bd56618ede0974dfe090b6264031ff2bc61093559f612e21e1030805

Download Submit
C:\Windows\TWJ0Q2W.exe

Filesize
585KB

MD5
1843b7445a84689e45962d5a2f7239a0

SHA1
d2e62464eac5b43c701b1a48bf09a01b7c565dd1

SHA256
604a60be7c541d08efda9f53a37e8bcaa40703b8fc384e5b87dda24fae721d29

SHA512
d7252a2cc52009651b5d27430854c06f63dab69d476cd20d909d0674d591f52772e65464bd56618ede0974dfe090b6264031ff2bc61093559f612e21e1030805

Download Submit
C:\Windows\TWJ0Q2W.exe

Filesize
585KB

MD5
964f274fe0be9947560478ba15c41b9c

SHA1
7eda90659c2c259af26ef2c93a6ed5eb3b072a54

SHA256
60ec1708154f4b67090928879a9ef68ac9af91b37039b47576bfadfb20059e88

SHA512
f3c592b9c760ea847465284cb4c87e51ae6d32014fbaa1067fdeb5b19c0d09cd954d44b7672d787f7c505539c1b95376a5aa8b61db948aec78699e0ec44a99b3

Download Submit
C:\Windows\TWJ0Q2W.exe

Filesize
585KB

MD5
e39be03b1e007add00c5aea814006cdb

SHA1
a7e0f841e5066a0cb6b3f822c01a92cab034a2ca

SHA256
1f45b089eb4c876c6b644c47685eac59b85b96d8ff4fa22a1ae7a6aebdae1c72

SHA512
97081e698db5da9b966437dd401dd05e3f425bbd2b213e591fae740e73268ac00a00395e6c6dacd8172048fc5d35976874fcd2e9ca2d7464e613f4a17a8f9014

Download Submit
C:\Windows\cypreg.dll

Filesize
417KB

MD5
380af134fab7517ce0e3620166cb31f6

SHA1
dd22ad39bb3f536f696a31902dd38034889ceadc

SHA256
8b4d4c46319b873872c909072304a6d9ccdb0ca2b390090a02286a66a9500e50

SHA512
e26142ad875954e0dbb00e2190ac436aae260e9cebb18ae53671928dc289309c9a6079f9b2b4763b21edc6d1ffe7f8487466fa6ac33ddb97d734026a4865cc51

Download Submit
C:\Windows\cypreg.dll

Filesize
417KB

MD5
eb44e8097c1eb2a5e1a22f393ddd6d45

SHA1
f80e54c86d77ee8d994cc966a3feaa6ccd261ef7

SHA256
dc97e08dbc2c3efcfa73031a94604224608c524a3b32dd73972e9422c3cc4566

SHA512
c6e4af7b8ca84818dd969345c29c100f9288e9dd98ac8fcf9f11b09cf0659acc26c9107d54228b4decd9e68988fd275579235ce715507a139bee8f002441d90c

Download Submit
C:\Windows\lsass.exe

Filesize
585KB

MD5
3c02569e609f404482aec548c7351846

SHA1
44546ee4aadf3118e720737d1ee9c5f54e8bdb57

SHA256
78af63a6f58d55de7778cc813a328558135ae320dde6eea3feb6f01684dfae11

SHA512
44a40841c975ebbec7b59dbb9cfa08a6e8ea6b99bab972659b2840ee775c5639f9cb1b2b09d42ac596151992d8862fbaba25044f264ac591da54bfe3af9f2751

Download Submit
C:\Windows\lsass.exe

Filesize
585KB

MD5
3c02569e609f404482aec548c7351846

SHA1
44546ee4aadf3118e720737d1ee9c5f54e8bdb57

SHA256
78af63a6f58d55de7778cc813a328558135ae320dde6eea3feb6f01684dfae11

SHA512
44a40841c975ebbec7b59dbb9cfa08a6e8ea6b99bab972659b2840ee775c5639f9cb1b2b09d42ac596151992d8862fbaba25044f264ac591da54bfe3af9f2751

Download Submit
C:\Windows\lsass.exe

Filesize
585KB

MD5
c2ab4d9e272d775bd9c85e6aef9631d3

SHA1
1c504e802a8c9473f0cba2ad809e7bf9900042f4

SHA256
9e59ec40562353499b836ae6f26eacea9600b7b9b13f3e437d888cd1fc461277

SHA512
95a34e76bcbf9d11953c302076e00837ecd896596c518085fa964f312289a0b35750cf28b268a9c414e574f8f04dfc1b4793a3c97246bbb57a4c188a3bd492d7

Download Submit
C:\Windows\lsass.exe

Filesize
585KB

MD5
c2ab4d9e272d775bd9c85e6aef9631d3

SHA1
1c504e802a8c9473f0cba2ad809e7bf9900042f4

SHA256
9e59ec40562353499b836ae6f26eacea9600b7b9b13f3e437d888cd1fc461277

SHA512
95a34e76bcbf9d11953c302076e00837ecd896596c518085fa964f312289a0b35750cf28b268a9c414e574f8f04dfc1b4793a3c97246bbb57a4c188a3bd492d7

Download Submit
C:\Windows\lsass.exe

Filesize
585KB

MD5
3c02569e609f404482aec548c7351846

SHA1
44546ee4aadf3118e720737d1ee9c5f54e8bdb57

SHA256
78af63a6f58d55de7778cc813a328558135ae320dde6eea3feb6f01684dfae11

SHA512
44a40841c975ebbec7b59dbb9cfa08a6e8ea6b99bab972659b2840ee775c5639f9cb1b2b09d42ac596151992d8862fbaba25044f264ac591da54bfe3af9f2751

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\moonlight.dll

Filesize
65KB

MD5
8e6e31f8df128a746ff9a3a38f8f78c0

SHA1
e4da9aa336eb7e254592e585b29d8b4e23f3e4bd

SHA256
dc33796b634ea14ed80a492257f698d103a57e1a041ccab92945efa8201a65f7

SHA512
eddacadcb86d8ead42185af5ce779f35dcbf262b2e12dc1cb816c3c5e35563201a839b861eb4a2cda472a5a27b2dfb76a0310d6eb94b49e9d5b58af869ef22c6

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\onceinabluemoon.mid

Filesize
8KB

MD5
0e528d000aad58b255c1cf8fd0bb1089

SHA1
2445d2cc0921aea9ae53b8920d048d6537940ec6

SHA256
c8aa5c023bf32f1c1e27b8136cf4d622101e58a80417d97271d3c0ba44528cae

SHA512
89ff6a1f1bf364925704a83ab4d222e2335e6486e0b90641f0133236b5f6b0fede1e9f17b577d6d069537e737b761f745d1fde4a9d0b43cb59143edf2d9c2116

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.3MB

MD5
731e4e6eb3ca5e3f9fbd9c2d15f88acd

SHA1
a8f3ac38530aaad6ecd5a507dfec22d26f7318f8

SHA256
9557659ccd3b1611ef457ec2bb61cd11f26c1b7b904d1e86f063996b681ba34c

SHA512
c0cd06fb068dec4eff0de4c8d17e9103c768c7c43807997be34654ca62139a5ade1cfadcf053716dff7d05f2cbc2f650359f5e2b1114e25420f1f65829540530

Download Submit
C:\Windows\system\msvbvm60.dll

Filesize
1.3MB

MD5
785b21c8ab8b1b9cd494711892fc8cd8

SHA1
f2dcf7c56d323794fd82f9560b2471ee5eb7c11d

SHA256
6fd8930c8eea4c3d277143a22875f41b83ffed42fa788c5b30f615e28a5622f0

SHA512
041e048979c415607503b088e8569c83e69df44ef5b97dce6afa8b43e8d7fb236a8048bd5ab0d82577e84c69b131ca1ce3649460b3220b8ac45447543a014077

Download Submit
\Windows\RXG5H8S\service.exe

Filesize
585KB

MD5
28fb4d1b02fba533dd858395655ba633

SHA1
db7e551d25af90a9a9d01885cc2b17ceecc6d473

SHA256
7e53a71dadba6860cfbae2423a0f6450c824dd66a4de32d9865a7ed6b1a550c1

SHA512
9afd81daf2c7c6a2de56d963998a43863434cd43b8b81128b84a9c5e64f4973993cfa46c86e5db43c6a4167515c5b101881a50a359d00fb0900f4c5340eb72a1

Download Submit
\Windows\RXG5H8S\service.exe

Filesize
585KB

MD5
28fb4d1b02fba533dd858395655ba633

SHA1
db7e551d25af90a9a9d01885cc2b17ceecc6d473

SHA256
7e53a71dadba6860cfbae2423a0f6450c824dd66a4de32d9865a7ed6b1a550c1

SHA512
9afd81daf2c7c6a2de56d963998a43863434cd43b8b81128b84a9c5e64f4973993cfa46c86e5db43c6a4167515c5b101881a50a359d00fb0900f4c5340eb72a1

Download Submit
\Windows\RXG5H8S\smss.exe

Filesize
585KB

MD5
08b605e99c2933400c487afccf8d7b8d

SHA1
18d182cf05edfabf6262b709e7edcecb483e182d

SHA256
34916e191c5682e99133c6028b8d8bde90cfb527d62e31fff80766118d5eac08

SHA512
c309d5ef6ddc7d907a23f5ace7505b441d56989d74ea78d4af1b0847a3a235555ad4cc9e06b88e906043c24dd94f8fa35b0ab55520b8ef540243cae985efe0a6

Download Submit
\Windows\RXG5H8S\smss.exe

Filesize
585KB

MD5
08b605e99c2933400c487afccf8d7b8d

SHA1
18d182cf05edfabf6262b709e7edcecb483e182d

SHA256
34916e191c5682e99133c6028b8d8bde90cfb527d62e31fff80766118d5eac08

SHA512
c309d5ef6ddc7d907a23f5ace7505b441d56989d74ea78d4af1b0847a3a235555ad4cc9e06b88e906043c24dd94f8fa35b0ab55520b8ef540243cae985efe0a6

Download Submit
\Windows\RXG5H8S\system.exe

Filesize
585KB

MD5
08b605e99c2933400c487afccf8d7b8d

SHA1
18d182cf05edfabf6262b709e7edcecb483e182d

SHA256
34916e191c5682e99133c6028b8d8bde90cfb527d62e31fff80766118d5eac08

SHA512
c309d5ef6ddc7d907a23f5ace7505b441d56989d74ea78d4af1b0847a3a235555ad4cc9e06b88e906043c24dd94f8fa35b0ab55520b8ef540243cae985efe0a6

Download Submit
memory/1068-144-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1068-186-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/1068-191-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/1068-185-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/1068-184-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/1068-178-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1068-223-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/1068-222-0x0000000010000000-0x0000000010075000-memory.dmp

Filesize
468KB

Download
memory/1764-228-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1764-195-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2444-61-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2444-176-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2520-69-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2520-177-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3028-175-0x0000000003220000-0x0000000003272000-memory.dmp

Filesize
328KB

Download
memory/3028-141-0x0000000003220000-0x0000000003272000-memory.dmp

Filesize
328KB

Download
memory/3028-0-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3028-189-0x0000000003890000-0x00000000038E2000-memory.dmp

Filesize
328KB

Download
memory/3028-59-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3028-57-0x0000000003220000-0x0000000003272000-memory.dmp

Filesize
328KB

Download
memory/3028-221-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3028-54-0x0000000003220000-0x0000000003272000-memory.dmp

Filesize
328KB

Download
memory/3028-194-0x0000000003890000-0x00000000038E2000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads