Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2023 10:25
Static task
static1
Behavioral task
behavioral1
Sample
ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exe
Resource
win10v2004-20231023-en
General
-
Target
ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exe
-
Size
251KB
-
MD5
965b7cbab5230f0610ecd96184b42cca
-
SHA1
903524674e6ba12dc8fbbbb18d102b406cff4fc9
-
SHA256
ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5d
-
SHA512
9c20bc8f1e6d037c40c55009718d2cbe74eb6d66cc3fe66f663d7b4532dc3ab11644347839d37d0f82fbad6cf9ebe4c4da5613e13ff158c3ad6b6f3dea4ef2f5
-
SSDEEP
3072:0Dpag5zPOTbWvICkrEj6eSgpWmssCMmWhDO5JqA8qr5ROVbzZ3:qb5jO2ZtJS2Wm5WQA8ma
Malware Config
Extracted
smokeloader
2022
http://onualituyrs.org/
http://sumagulituyo.org/
http://snukerukeutit.org/
http://lightseinsteniki.org/
http://liuliuoumumy.org/
http://stualialuyastrelia.net/
http://kumbuyartyty.net/
http://criogetikfenbut.org/
http://tonimiuyaytre.org/
http://tyiuiunuewqy.org/
http://humydrole.com/tmp/index.php
http://trunk-co.ru/tmp/index.php
http://weareelight.com/tmp/index.php
http://pirateking.online/tmp/index.php
http://piratia.pw/tmp/index.php
http://go-piratia.ru/tmp/index.php
Extracted
redline
LogsDiller Cloud (Bot: @logsdillabot)
194.49.94.181:40264
Extracted
amadey
4.12
http://185.172.128.19
-
install_dir
cd1f156d67
-
install_file
Utsysc.exe
-
strings_key
0dd3e5ee91b367c60c9e575983554b30
-
url_paths
/ghsdh39s/index.php
Extracted
djvu
http://zexeq.com/lancer/get.php
-
extension
.gycc
-
offline_id
nN1rRlTxKTPo66pmJEAHwufZ2Dhz4MsNxIlOk6t1
-
payload_url
http://brusuax.com/dl/build2.exe
http://zexeq.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-CDZ4hMgp2X Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0829ASdw
Extracted
smokeloader
pub1
Extracted
amadey
3.83
http://5.42.65.80
-
install_dir
207aa4515d
-
install_file
oneetx.exe
-
strings_key
3e634dd0840c68ae2ced83c2be7bf0d4
-
url_paths
/8bmeVwqx/index.php
Signatures
-
Detected Djvu ransomware 8 IoCs
Processes:
resource yara_rule behavioral2/memory/1156-153-0x0000000004970000-0x0000000004A8B000-memory.dmp family_djvu behavioral2/memory/2684-173-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2684-176-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2684-180-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2684-230-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3532-255-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3532-256-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3532-259-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Glupteba payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4432-262-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/4432-318-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/768-328-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/768-389-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/768-421-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3844-447-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba behavioral2/memory/3844-521-0x0000000000400000-0x0000000000D1C000-memory.dmp family_glupteba -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1672-101-0x0000000000400000-0x000000000043C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
5F73.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 5F73.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
5F73.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5F73.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5F73.exe -
Checks computer location settings 2 TTPs 4 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
8B68.exe9453.exefinerock.exe5ABD.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation 8B68.exe Key value queried \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation 9453.exe Key value queried \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation finerock.exe Key value queried \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Control Panel\International\Geo\Nation 5ABD.exe -
Deletes itself 1 IoCs
Processes:
pid process 3368 -
Executes dropped EXE 22 IoCs
Processes:
5ABD.exe5F73.exe634C.exe733B.exe8B68.exe90B8.exe9453.exe288c47bbc1871b439df19ff4df68f076.exeInstallSetup8.exe5ABD.exeBroom.exefinerock.exeoneetx.exe5ABD.exe9453.exe5ABD.exe288c47bbc1871b439df19ff4df68f076.execsrss.exe9453.exeinjector.exewindefender.exewindefender.exepid process 1156 5ABD.exe 1252 5F73.exe 3756 634C.exe 4816 733B.exe 3140 8B68.exe 2232 90B8.exe 3196 9453.exe 4432 288c47bbc1871b439df19ff4df68f076.exe 3240 InstallSetup8.exe 2684 5ABD.exe 1012 Broom.exe 996 finerock.exe 2092 oneetx.exe 2580 5ABD.exe 3836 9453.exe 3532 5ABD.exe 768 288c47bbc1871b439df19ff4df68f076.exe 3844 csrss.exe 4596 9453.exe 5064 injector.exe 3076 windefender.exe 3648 windefender.exe -
Loads dropped DLL 1 IoCs
Processes:
regsvr32.exepid process 4972 regsvr32.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\5F73.exe themida C:\Users\Admin\AppData\Local\Temp\5F73.exe themida behavioral2/memory/1252-45-0x0000000000380000-0x0000000000BB2000-memory.dmp themida -
Processes:
resource yara_rule C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx C:\Windows\windefender.exe upx -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
5ABD.exe288c47bbc1871b439df19ff4df68f076.execsrss.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\42905910-c57b-403a-be14-fe291fdc1ded\\5ABD.exe\" --AutoStart" 5ABD.exe Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
5F73.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5F73.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 62 api.2ip.ua 63 api.2ip.ua -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 7 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
5F73.exepid process 1252 5F73.exe -
Suspicious use of SetThreadContext 6 IoCs
Processes:
634C.exe5ABD.exe5ABD.exe90B8.exeAddInProcess32.exedescription pid process target process PID 3756 set thread context of 1672 3756 634C.exe AppLaunch.exe PID 1156 set thread context of 2684 1156 5ABD.exe 5ABD.exe PID 2580 set thread context of 3532 2580 5ABD.exe 5ABD.exe PID 2232 set thread context of 2080 2232 90B8.exe AddInProcess32.exe PID 2232 set thread context of 1600 2232 90B8.exe AddInProcess32.exe PID 2080 set thread context of 3876 2080 AddInProcess32.exe InstallUtil.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
288c47bbc1871b439df19ff4df68f076.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN 288c47bbc1871b439df19ff4df68f076.exe -
Drops file in Windows directory 4 IoCs
Processes:
288c47bbc1871b439df19ff4df68f076.execsrss.exedescription ioc process File created C:\Windows\rss\csrss.exe 288c47bbc1871b439df19ff4df68f076.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\rss 288c47bbc1871b439df19ff4df68f076.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4804 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2728 3532 WerFault.exe 5ABD.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exe733B.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 733B.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 733B.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 733B.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2952 schtasks.exe 1584 schtasks.exe 2008 schtasks.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
288c47bbc1871b439df19ff4df68f076.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-872 = "Pakistan Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" 288c47bbc1871b439df19ff4df68f076.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-32 = "Mid-Atlantic Standard Time" 288c47bbc1871b439df19ff4df68f076.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" 288c47bbc1871b439df19ff4df68f076.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exepid process 5044 ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exe 5044 ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exe 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 3368 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3368 -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exe733B.exepid process 5044 ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exe 3368 3368 3368 3368 4816 733B.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
90B8.exeAppLaunch.exe5F73.exepowershell.exe288c47bbc1871b439df19ff4df68f076.exepowershell.exepowershell.exepowershell.exeAddInProcess32.exepowershell.exepowershell.exedescription pid process Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeDebugPrivilege 2232 90B8.exe Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeDebugPrivilege 1672 AppLaunch.exe Token: SeDebugPrivilege 1252 5F73.exe Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeDebugPrivilege 1600 powershell.exe Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeDebugPrivilege 4432 288c47bbc1871b439df19ff4df68f076.exe Token: SeImpersonatePrivilege 4432 288c47bbc1871b439df19ff4df68f076.exe Token: SeDebugPrivilege 3568 powershell.exe Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeDebugPrivilege 3060 powershell.exe Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeDebugPrivilege 4604 powershell.exe Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeDebugPrivilege 2080 AddInProcess32.exe Token: SeDebugPrivilege 4800 powershell.exe Token: SeShutdownPrivilege 3368 Token: SeCreatePagefilePrivilege 3368 Token: SeDebugPrivilege 3552 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
finerock.exepid process 996 finerock.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Broom.exepid process 1012 Broom.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
pid process 3368 -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
regsvr32.exe634C.exe8B68.exe9453.exe5ABD.exeInstallSetup8.exedescription pid process target process PID 3368 wrote to memory of 1156 3368 5ABD.exe PID 3368 wrote to memory of 1156 3368 5ABD.exe PID 3368 wrote to memory of 1156 3368 5ABD.exe PID 3368 wrote to memory of 4388 3368 regsvr32.exe PID 3368 wrote to memory of 4388 3368 regsvr32.exe PID 4388 wrote to memory of 4972 4388 regsvr32.exe regsvr32.exe PID 4388 wrote to memory of 4972 4388 regsvr32.exe regsvr32.exe PID 4388 wrote to memory of 4972 4388 regsvr32.exe regsvr32.exe PID 3368 wrote to memory of 1252 3368 5F73.exe PID 3368 wrote to memory of 1252 3368 5F73.exe PID 3368 wrote to memory of 1252 3368 5F73.exe PID 3368 wrote to memory of 3756 3368 634C.exe PID 3368 wrote to memory of 3756 3368 634C.exe PID 3368 wrote to memory of 3756 3368 634C.exe PID 3368 wrote to memory of 4816 3368 733B.exe PID 3368 wrote to memory of 4816 3368 733B.exe PID 3368 wrote to memory of 4816 3368 733B.exe PID 3368 wrote to memory of 3140 3368 8B68.exe PID 3368 wrote to memory of 3140 3368 8B68.exe PID 3368 wrote to memory of 3140 3368 8B68.exe PID 3756 wrote to memory of 1672 3756 634C.exe AppLaunch.exe PID 3756 wrote to memory of 1672 3756 634C.exe AppLaunch.exe PID 3756 wrote to memory of 1672 3756 634C.exe AppLaunch.exe PID 3756 wrote to memory of 1672 3756 634C.exe AppLaunch.exe PID 3756 wrote to memory of 1672 3756 634C.exe AppLaunch.exe PID 3756 wrote to memory of 1672 3756 634C.exe AppLaunch.exe PID 3756 wrote to memory of 1672 3756 634C.exe AppLaunch.exe PID 3756 wrote to memory of 1672 3756 634C.exe AppLaunch.exe PID 3368 wrote to memory of 2232 3368 90B8.exe PID 3368 wrote to memory of 2232 3368 90B8.exe PID 3368 wrote to memory of 2232 3368 90B8.exe PID 3368 wrote to memory of 3196 3368 9453.exe PID 3368 wrote to memory of 3196 3368 9453.exe PID 3368 wrote to memory of 3196 3368 9453.exe PID 3368 wrote to memory of 3680 3368 explorer.exe PID 3368 wrote to memory of 3680 3368 explorer.exe PID 3368 wrote to memory of 3680 3368 explorer.exe PID 3368 wrote to memory of 3680 3368 explorer.exe PID 3140 wrote to memory of 4432 3140 8B68.exe 288c47bbc1871b439df19ff4df68f076.exe PID 3140 wrote to memory of 4432 3140 8B68.exe 288c47bbc1871b439df19ff4df68f076.exe PID 3140 wrote to memory of 4432 3140 8B68.exe 288c47bbc1871b439df19ff4df68f076.exe PID 3140 wrote to memory of 3240 3140 8B68.exe InstallSetup8.exe PID 3140 wrote to memory of 3240 3140 8B68.exe InstallSetup8.exe PID 3140 wrote to memory of 3240 3140 8B68.exe InstallSetup8.exe PID 3368 wrote to memory of 1836 3368 explorer.exe PID 3368 wrote to memory of 1836 3368 explorer.exe PID 3368 wrote to memory of 1836 3368 explorer.exe PID 3196 wrote to memory of 2008 3196 9453.exe schtasks.exe PID 3196 wrote to memory of 2008 3196 9453.exe schtasks.exe PID 3196 wrote to memory of 2008 3196 9453.exe schtasks.exe PID 1156 wrote to memory of 2684 1156 5ABD.exe 5ABD.exe PID 1156 wrote to memory of 2684 1156 5ABD.exe 5ABD.exe PID 1156 wrote to memory of 2684 1156 5ABD.exe 5ABD.exe PID 1156 wrote to memory of 2684 1156 5ABD.exe 5ABD.exe PID 1156 wrote to memory of 2684 1156 5ABD.exe 5ABD.exe PID 1156 wrote to memory of 2684 1156 5ABD.exe 5ABD.exe PID 1156 wrote to memory of 2684 1156 5ABD.exe 5ABD.exe PID 1156 wrote to memory of 2684 1156 5ABD.exe 5ABD.exe PID 1156 wrote to memory of 2684 1156 5ABD.exe 5ABD.exe PID 1156 wrote to memory of 2684 1156 5ABD.exe 5ABD.exe PID 3240 wrote to memory of 1012 3240 InstallSetup8.exe Broom.exe PID 3240 wrote to memory of 1012 3240 InstallSetup8.exe Broom.exe PID 3240 wrote to memory of 1012 3240 InstallSetup8.exe Broom.exe PID 3196 wrote to memory of 996 3196 9453.exe finerock.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-984744499-3605095035-265325720-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exe"C:\Users\Admin\AppData\Local\Temp\ddc7a9963c1c75fe62b5a93b7411424c58d2dd849cecc019fa5554e8cd55ab5dexe.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\5ABD.exeC:\Users\Admin\AppData\Local\Temp\5ABD.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5ABD.exeC:\Users\Admin\AppData\Local\Temp\5ABD.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\42905910-c57b-403a-be14-fe291fdc1ded" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\5ABD.exe"C:\Users\Admin\AppData\Local\Temp\5ABD.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\5ABD.exe"C:\Users\Admin\AppData\Local\Temp\5ABD.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3532 -s 5685⤵
- Program crash
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\5CC2.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\5CC2.dll2⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\5F73.exeC:\Users\Admin\AppData\Local\Temp\5F73.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\634C.exeC:\Users\Admin\AppData\Local\Temp\634C.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\733B.exeC:\Users\Admin\AppData\Local\Temp\733B.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\8B68.exeC:\Users\Admin\AppData\Local\Temp\8B68.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll5⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)6⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
- Launches sc.exe
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeC:\Users\Admin\AppData\Local\Temp\Broom.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\90B8.exeC:\Users\Admin\AppData\Local\Temp\90B8.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\9453.exeC:\Users\Admin\AppData\Local\Temp\9453.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN 9453.exe /TR "C:\Users\Admin\AppData\Local\Temp\9453.exe" /F2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\1000011001\finerock.exe"C:\Users\Admin\AppData\Local\Temp\1000011001\finerock.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\9453.exeC:\Users\Admin\AppData\Local\Temp\9453.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3532 -ip 35321⤵
-
C:\Users\Admin\AppData\Local\Temp\9453.exeC:\Users\Admin\AppData\Local\Temp\9453.exe1⤵
- Executes dropped EXE
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Virtualization/Sandbox Evasion
1File and Directory Permissions Modification
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\42905910-c57b-403a-be14-fe291fdc1ded\5ABD.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\1000011001\finerock.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\1000011001\finerock.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\1000011001\finerock.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeFilesize
198KB
MD5a64a886a695ed5fb9273e73241fec2f7
SHA1363244ca05027c5beb938562df5b525a2428b405
SHA256563acabe49cc451e9caac20fae780bad27ea09aaefaaf8a1dfd838a00de97144
SHA512122779ad7bce927e1b881df181fcc3181080d3929a67f750358fa446a21397b998d167c03aed5f3bdc3cd7a1f17e4da095f9b4a9367c6357cabefcf8cdd29474
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Users\Admin\AppData\Local\Temp\5ABD.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\5ABD.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\5ABD.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\5ABD.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\5ABD.exeFilesize
832KB
MD5ef4690a39d2df67899b879f38704d0bd
SHA13625f5087fec6b89977f4f49a9cae32d731aaebc
SHA25600ea9e04a21a848eb1751c907bf12a9dfbfe7229499b3e2143dc41e5dda79214
SHA512283ba9a22c3916deaecd632c880e47a1092b4ab8f0ccdc7c31ffc55d174dc16bec5e247d5fe93a012bc537e57eefa92b90f424cccb38271efb8a06388bb09084
-
C:\Users\Admin\AppData\Local\Temp\5CC2.dllFilesize
1.6MB
MD54164fa66f608eb71f038fa7ee6ece5bc
SHA1d879704e3d4f1ddb97cde3100962dfb684458c27
SHA256b43fbe5adf27e984234a4abff46adc22241bcb5b894ce7b518aa024a4c6556f8
SHA51235dbc13c03cb155ad920fc82de78456cc0aa174671a7ac96953693111596be2bd30e4a0d35e2002f66ddc4e3341f90c3a2d71f35607eaca4673e6a5b6b76edb0
-
C:\Users\Admin\AppData\Local\Temp\5CC2.dllFilesize
1.6MB
MD54164fa66f608eb71f038fa7ee6ece5bc
SHA1d879704e3d4f1ddb97cde3100962dfb684458c27
SHA256b43fbe5adf27e984234a4abff46adc22241bcb5b894ce7b518aa024a4c6556f8
SHA51235dbc13c03cb155ad920fc82de78456cc0aa174671a7ac96953693111596be2bd30e4a0d35e2002f66ddc4e3341f90c3a2d71f35607eaca4673e6a5b6b76edb0
-
C:\Users\Admin\AppData\Local\Temp\5F73.exeFilesize
2.9MB
MD52f084751d838cb9bfcc8538401245ca6
SHA16353a9b23d8e4b50e85cd8e352d4f8d33111b9c0
SHA256c189f0fb469d1614cabaf2c7ecad116504f2a89da8c51f371dd28571dc45a13c
SHA51293b8fc0d072f4c162267dcfe9e25e1ec5fe305f4e6e0a87dd84698ded16089430c2bda52129064efdfe22c8ea66566d85e55829837e044459c0fe7e0be55011d
-
C:\Users\Admin\AppData\Local\Temp\5F73.exeFilesize
2.9MB
MD52f084751d838cb9bfcc8538401245ca6
SHA16353a9b23d8e4b50e85cd8e352d4f8d33111b9c0
SHA256c189f0fb469d1614cabaf2c7ecad116504f2a89da8c51f371dd28571dc45a13c
SHA51293b8fc0d072f4c162267dcfe9e25e1ec5fe305f4e6e0a87dd84698ded16089430c2bda52129064efdfe22c8ea66566d85e55829837e044459c0fe7e0be55011d
-
C:\Users\Admin\AppData\Local\Temp\634C.exeFilesize
1.1MB
MD5acfa549f63796da0e45b5d96755c425b
SHA1e0b9ab6d6878926c95e7ead1dd5578aec686566a
SHA2564d588cff4cf07df5dc8e999f0962c2bfc83f69e8e6ec8df6acb06eb729b26480
SHA51295d5f5c71e25aa327b723893a0aefc7545993448d7c7e99fb2aa7dfbf7f699e2e5584ab745dcb1c18867520a0bb558c0a33371709174cf1c80c0be2e7e025743
-
C:\Users\Admin\AppData\Local\Temp\634C.exeFilesize
1.1MB
MD5acfa549f63796da0e45b5d96755c425b
SHA1e0b9ab6d6878926c95e7ead1dd5578aec686566a
SHA2564d588cff4cf07df5dc8e999f0962c2bfc83f69e8e6ec8df6acb06eb729b26480
SHA51295d5f5c71e25aa327b723893a0aefc7545993448d7c7e99fb2aa7dfbf7f699e2e5584ab745dcb1c18867520a0bb558c0a33371709174cf1c80c0be2e7e025743
-
C:\Users\Admin\AppData\Local\Temp\733B.exeFilesize
290KB
MD5b6e9ec2a10fb6b8eaa96a916140244cb
SHA1b82aef0315c6341bac8e4cbe63c2e494bf194758
SHA25628ac808f2ace1fc11007ce590b9e65e00a15e69bd2cb637086ef36099d6952d9
SHA5123ea894125f706e751aec09fe5015ca7e604f153468b3833617a0b4cb3d3777d8535d98bead2f50c193fc8dafcc7d4d80ed629eb44c2b412720bf798c431f873c
-
C:\Users\Admin\AppData\Local\Temp\733B.exeFilesize
290KB
MD5b6e9ec2a10fb6b8eaa96a916140244cb
SHA1b82aef0315c6341bac8e4cbe63c2e494bf194758
SHA25628ac808f2ace1fc11007ce590b9e65e00a15e69bd2cb637086ef36099d6952d9
SHA5123ea894125f706e751aec09fe5015ca7e604f153468b3833617a0b4cb3d3777d8535d98bead2f50c193fc8dafcc7d4d80ed629eb44c2b412720bf798c431f873c
-
C:\Users\Admin\AppData\Local\Temp\8B68.exeFilesize
6.4MB
MD5faa78f58b4f091f8c56ea622d8576703
SHA12bd05e7cf298f79bc7408f400e2f2fd37fc8bdf1
SHA256464c7ab944886103d617e334c94320344761a543de5395c6b541ae386b448ea0
SHA5123037aef0866b9957fd9f56691baa0e6557a9f46cd3695016dc3c829fc270393360b05e39fba19dc10cac06c2f51998716b3c15c57c3f0afe8c11b2a3709d467b
-
C:\Users\Admin\AppData\Local\Temp\8B68.exeFilesize
6.4MB
MD5faa78f58b4f091f8c56ea622d8576703
SHA12bd05e7cf298f79bc7408f400e2f2fd37fc8bdf1
SHA256464c7ab944886103d617e334c94320344761a543de5395c6b541ae386b448ea0
SHA5123037aef0866b9957fd9f56691baa0e6557a9f46cd3695016dc3c829fc270393360b05e39fba19dc10cac06c2f51998716b3c15c57c3f0afe8c11b2a3709d467b
-
C:\Users\Admin\AppData\Local\Temp\90B8.exeFilesize
1.8MB
MD5fac406eb3a620ec45654e087f68ccd9e
SHA102c21bd71ec411685102670cd4342a332ebaade0
SHA256de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340
SHA5122668c162ccc01f61a1a9ffec6b35a0c2f64b6f0f5a724f1563b3b23460ed17faa7e64d6817f0eaf7f9c38f3a1ac4fb730351d197b9fff051f25d6e1aac4d2b11
-
C:\Users\Admin\AppData\Local\Temp\90B8.exeFilesize
1.8MB
MD5fac406eb3a620ec45654e087f68ccd9e
SHA102c21bd71ec411685102670cd4342a332ebaade0
SHA256de955b499b42824606d86071bdb1f1555df518b3f12b0254d674a20876e9d340
SHA5122668c162ccc01f61a1a9ffec6b35a0c2f64b6f0f5a724f1563b3b23460ed17faa7e64d6817f0eaf7f9c38f3a1ac4fb730351d197b9fff051f25d6e1aac4d2b11
-
C:\Users\Admin\AppData\Local\Temp\9453.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\9453.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\9453.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\9453.exeFilesize
418KB
MD50099a99f5ffb3c3ae78af0084136fab3
SHA10205a065728a9ec1133e8a372b1e3864df776e8c
SHA256919ae827ff59fcbe3dbaea9e62855a4d27690818189f696cfb5916a88c823226
SHA5125ac4f3265c7dd7d172284fb28c94f8fc6428c27853e70989f4ec4208f9897be91720e8eee1906d8e843ab05798f3279a12492a32e8a118f5621ac5e1be2031b6
-
C:\Users\Admin\AppData\Local\Temp\Broom.exeFilesize
5.3MB
MD500e93456aa5bcf9f60f84b0c0760a212
SHA16096890893116e75bd46fea0b8c3921ceb33f57d
SHA256ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504
SHA512abd2be819c7d93bd6097155cf84eaf803e3133a7e0ca71f9d9cbc3c65e4e4a26415d2523a36adafdd19b0751e25ea1a99b8d060cad61cdfd1f79adf9cd4b4eca
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exeFilesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exeFilesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exeFilesize
2.3MB
MD5d56df2995b539368495f3300e48d8e18
SHA18d2d02923afb5fb5e09ce1592104db17a3128246
SHA256b87fd3c98383089618d2f66cbbecd2b0ed91db6923135235eb52a671f8dd7cb6
SHA5122b25f9b2ff56abafcd8aa0a5fbae4ea78e9e95cec3d4cb832a7a3c5ec13af7d9ecf3ef26ec5c7144805868801aacb8de4113490c3bd665fda4e23ec05b9d8008
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rdrukqwp.r4g.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Roaming\ggteeetFilesize
290KB
MD5b6e9ec2a10fb6b8eaa96a916140244cb
SHA1b82aef0315c6341bac8e4cbe63c2e494bf194758
SHA25628ac808f2ace1fc11007ce590b9e65e00a15e69bd2cb637086ef36099d6952d9
SHA5123ea894125f706e751aec09fe5015ca7e604f153468b3833617a0b4cb3d3777d8535d98bead2f50c193fc8dafcc7d4d80ed629eb44c2b412720bf798c431f873c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5d8fe7b743017c7c86c6bc8cd46f105a5
SHA1c66073a6921c10c71f37b0cae4f54edcefd6eb5b
SHA2564403abf2816cb6b36c456d799bb84e4193b538e90a5f0ec275f2801812a50720
SHA51214d21652291f93f033d071d024f1369ce385abf8f79ab04072d5cfbef6edcf33d7c45620ce7a14eca8b73c0d90a76f5359c3e131d4bfc6c1789ae51cc4af3820
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5ccb94a16018c53110ebce56dd6f3f0de
SHA1fcb111ffba36a2769f5086e3ff8319708d6bd438
SHA256e8aa3f3519a35b9fed0084cc2ed39a53822a642e02251cd7b9f7e3d3a28ce9f4
SHA512099cc944ca37fb111c373b2268ea4f4999885f7b1d6bfe1dd497a6b9acb7ad40f709ae61aed9baa91a04e59209c5ab61fa37289aa704ed2d473b284481831b73
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD536ab5c949cfeab621bf874435356aad2
SHA14687238fbb68a990bb2c578dfac72818ba189e83
SHA256246b7911fbd422d62115d99df965c2adedfac47ae71e79208c9f222c61fef66c
SHA512cc262ca055912c9d0c8e24eb6603be56b6a43de95b284f0336dea36cf6de071e13f57dc063cd3faadf445eece8cacf3399a33ba6f218702a5cf102bd97d73323
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5e96b8df83082a5f2e1cc4daf0eb161b5
SHA1f0506dbd4c734e1c1c1ea91aaf45bc6202fe1e82
SHA256f8d619e456b90eeaa12181fc1f6dde9def7c4768e89daf345618b30a17ed29f6
SHA5126099d2e138cc80c9dbb30d8ca343fac29c4c2f7cf573b2a9f3eb92acac2c6532df4cae07b55f67cff850d8f2e42d2c89aec93ad6390577801c12f7529bbb96ae
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD57369cbd85f79336ccf0e8ef4211a7d14
SHA169e4a98600b42763e6164d5d5a6afce3221bcfd2
SHA25678563ff709a6fe614c74b04b17dabd04b3fa4356a48e037aabee0f1e59288970
SHA512ceb82a0545b59cdd341738b494df5a01289118e6a724512a446eac4aaec817ce35c324fe2896086ea28020d0e9309d0e20e3b4c31205ded378855851364e859c
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Windows\rss\csrss.exeFilesize
4.2MB
MD5890bfdf3c7eecbb505c0fdc415f466b3
SHA190889e27be89519f23d85915956d989b75793c8d
SHA256e617e19dce9f15496c331be6daf2006a03573d50e42b34f2ae9ee4aee2bc8c72
SHA512e08f327a03ede89a8e8df0a50244458095ed8afd132be8f21323cb81cfe5fb09d18266d0f5186dfd12d48649ffbb2dd1c8ec35951702f2b99adb1075fd776ece
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/768-421-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/768-328-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/768-389-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/1012-284-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB
-
memory/1012-237-0x0000000000400000-0x0000000000965000-memory.dmpFilesize
5.4MB
-
memory/1156-153-0x0000000004970000-0x0000000004A8B000-memory.dmpFilesize
1.1MB
-
memory/1156-146-0x00000000047F0000-0x0000000004887000-memory.dmpFilesize
604KB
-
memory/1252-88-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-70-0x0000000007D80000-0x0000000007D92000-memory.dmpFilesize
72KB
-
memory/1252-34-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-45-0x0000000000380000-0x0000000000BB2000-memory.dmpFilesize
8.2MB
-
memory/1252-48-0x0000000007AE0000-0x0000000007B72000-memory.dmpFilesize
584KB
-
memory/1252-132-0x00000000087E0000-0x0000000008846000-memory.dmpFilesize
408KB
-
memory/1252-75-0x0000000007DE0000-0x0000000007E1C000-memory.dmpFilesize
240KB
-
memory/1252-69-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-94-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-95-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-96-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-33-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-31-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-85-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-87-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-54-0x0000000007C90000-0x0000000007C9A000-memory.dmpFilesize
40KB
-
memory/1252-32-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-65-0x0000000007E70000-0x0000000007F7A000-memory.dmpFilesize
1.0MB
-
memory/1252-42-0x00000000779F4000-0x00000000779F6000-memory.dmpFilesize
8KB
-
memory/1252-28-0x0000000000380000-0x0000000000BB2000-memory.dmpFilesize
8.2MB
-
memory/1252-62-0x0000000000380000-0x0000000000BB2000-memory.dmpFilesize
8.2MB
-
memory/1252-61-0x0000000008B70000-0x0000000009188000-memory.dmpFilesize
6.1MB
-
memory/1252-66-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-40-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-79-0x0000000007E20000-0x0000000007E6C000-memory.dmpFilesize
304KB
-
memory/1252-47-0x0000000007FA0000-0x0000000008544000-memory.dmpFilesize
5.6MB
-
memory/1252-37-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-30-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1252-29-0x0000000075C80000-0x0000000075D70000-memory.dmpFilesize
960KB
-
memory/1672-108-0x00000000078D0000-0x00000000078E0000-memory.dmpFilesize
64KB
-
memory/1672-107-0x00000000735F0000-0x0000000073DA0000-memory.dmpFilesize
7.7MB
-
memory/1672-101-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1836-142-0x0000000001080000-0x000000000108C000-memory.dmpFilesize
48KB
-
memory/1836-154-0x0000000001080000-0x000000000108C000-memory.dmpFilesize
48KB
-
memory/2080-425-0x0000000000400000-0x00000000004CE000-memory.dmpFilesize
824KB
-
memory/2080-424-0x0000000000400000-0x00000000004CE000-memory.dmpFilesize
824KB
-
memory/2232-115-0x0000000004B80000-0x0000000004C1C000-memory.dmpFilesize
624KB
-
memory/2232-114-0x0000000000B00000-0x0000000000CC8000-memory.dmpFilesize
1.8MB
-
memory/2232-113-0x00000000735F0000-0x0000000073DA0000-memory.dmpFilesize
7.7MB
-
memory/2684-230-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2684-180-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2684-173-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2684-176-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3140-143-0x00000000735F0000-0x0000000073DA0000-memory.dmpFilesize
7.7MB
-
memory/3140-103-0x0000000000BF0000-0x0000000001264000-memory.dmpFilesize
6.5MB
-
memory/3140-105-0x00000000735F0000-0x0000000073DA0000-memory.dmpFilesize
7.7MB
-
memory/3368-52-0x00000000076F0000-0x0000000007700000-memory.dmpFilesize
64KB
-
memory/3368-80-0x0000000002E30000-0x0000000002E40000-memory.dmpFilesize
64KB
-
memory/3368-89-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-53-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-141-0x0000000002E30000-0x0000000002E40000-memory.dmpFilesize
64KB
-
memory/3368-58-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-56-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-55-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-60-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-76-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-78-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-82-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-83-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-51-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-224-0x0000000002E80000-0x0000000002E96000-memory.dmpFilesize
88KB
-
memory/3368-77-0x0000000002E30000-0x0000000002E40000-memory.dmpFilesize
64KB
-
memory/3368-174-0x0000000002CA0000-0x0000000002CA1000-memory.dmpFilesize
4KB
-
memory/3368-4-0x0000000002C60000-0x0000000002C76000-memory.dmpFilesize
88KB
-
memory/3368-144-0x0000000002E30000-0x0000000002E40000-memory.dmpFilesize
64KB
-
memory/3368-93-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-74-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-68-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-63-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-49-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-86-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-92-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3368-90-0x0000000002CA0000-0x0000000002CA1000-memory.dmpFilesize
4KB
-
memory/3368-84-0x00000000076E0000-0x00000000076F0000-memory.dmpFilesize
64KB
-
memory/3532-259-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3532-256-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3532-255-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3680-131-0x00000000004E0000-0x000000000054B000-memory.dmpFilesize
428KB
-
memory/3680-129-0x0000000000550000-0x00000000005C5000-memory.dmpFilesize
468KB
-
memory/3680-128-0x00000000004E0000-0x000000000054B000-memory.dmpFilesize
428KB
-
memory/3844-447-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/3844-521-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4432-262-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4432-318-0x0000000000400000-0x0000000000D1C000-memory.dmpFilesize
9.1MB
-
memory/4816-178-0x0000000002C00000-0x0000000002D00000-memory.dmpFilesize
1024KB
-
memory/4816-228-0x0000000000400000-0x0000000002AC0000-memory.dmpFilesize
38.8MB
-
memory/4816-181-0x0000000002B50000-0x0000000002B5B000-memory.dmpFilesize
44KB
-
memory/4972-207-0x0000000003270000-0x0000000003380000-memory.dmpFilesize
1.1MB
-
memory/4972-205-0x0000000003270000-0x0000000003380000-memory.dmpFilesize
1.1MB
-
memory/4972-197-0x0000000003270000-0x0000000003380000-memory.dmpFilesize
1.1MB
-
memory/4972-23-0x0000000002FC0000-0x0000000002FC6000-memory.dmpFilesize
24KB
-
memory/4972-22-0x0000000010000000-0x0000000010192000-memory.dmpFilesize
1.6MB
-
memory/4972-145-0x0000000003130000-0x000000000325D000-memory.dmpFilesize
1.2MB
-
memory/5044-1-0x0000000000670000-0x0000000000770000-memory.dmpFilesize
1024KB
-
memory/5044-5-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/5044-3-0x0000000000400000-0x00000000004F2000-memory.dmpFilesize
968KB
-
memory/5044-2-0x0000000000660000-0x000000000066B000-memory.dmpFilesize
44KB