a310logger | 139b8756b01add9dcac07d3a0137b0ea49a932fc4804ad0eca63ffc2958eda72

Analysis

max time kernel
138s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30-12-2023 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bb1c29f4a8c046e798cd9781cc127a7.exe
Size

876KB
MD5

0bb1c29f4a8c046e798cd9781cc127a7
SHA1

bbad89c8d04b20f63d36014f00ded3818e595a53
SHA256

139b8756b01add9dcac07d3a0137b0ea49a932fc4804ad0eca63ffc2958eda72
SHA512

4b439bd85c725f104be24956525a6ae1a16dba28fe254695cbd667933d0cce2225e9a0f934ef17e1f5ef65ac033aa6ed72d016e3bed0bf270dd3d1eef12de63f
SSDEEP

12288:+nkguFRskuUAlWC/44toU73kJiIWK4vV9BrFZsk1q1/1Yah2UKbnltqvTmDcN:0kEkuUAlV46zbk6K6VVZsuSYgF+qvH

Score

10^/10

a310logger blustealer collection spyware stealer

Malware Config

Extracted

Family

blustealer

Credentials

Protocol: smtp
Host:
smtp.privateemail.com
Port:
587
Username:
[email protected]
Password:
@@@@@@

Signatures

A310logger
A310 Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
stealer spyware a310logger
BluStealer
A Modular information stealer written in Visual Basic.
stealer blustealer

A310logger Executable 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000015c40-49.dat	a310logger
behavioral1/memory/1964-53-0x0000000000CF0000-0x0000000000DA2000-memory.dmp	a310logger

Executes dropped EXE 1 IoCs

pid	Process
1964	Fox.exe

Loads dropped DLL 1 IoCs

pid	Process
1712	0bb1c29f4a8c046e798cd9781cc127a7.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Fox.exe
Key opened	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Fox.exe
Key opened	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Fox.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2408 set thread context of 1712	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1660	schtasks.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	0bb1c29f4a8c046e798cd9781cc127a7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	0bb1c29f4a8c046e798cd9781cc127a7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	0bb1c29f4a8c046e798cd9781cc127a7.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	0bb1c29f4a8c046e798cd9781cc127a7.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1712	0bb1c29f4a8c046e798cd9781cc127a7.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1712	0bb1c29f4a8c046e798cd9781cc127a7.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1712	0bb1c29f4a8c046e798cd9781cc127a7.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 1660	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	30
PID 2408 wrote to memory of 1660	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	30
PID 2408 wrote to memory of 1660	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	30
PID 2408 wrote to memory of 1660	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	30
PID 2408 wrote to memory of 1712	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	32
PID 2408 wrote to memory of 1712	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	32
PID 2408 wrote to memory of 1712	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	32
PID 2408 wrote to memory of 1712	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	32
PID 2408 wrote to memory of 1712	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	32
PID 2408 wrote to memory of 1712	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	32
PID 2408 wrote to memory of 1712	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	32
PID 2408 wrote to memory of 1712	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	32
PID 2408 wrote to memory of 1712	2408	0bb1c29f4a8c046e798cd9781cc127a7.exe	32
PID 1712 wrote to memory of 1964	1712	0bb1c29f4a8c046e798cd9781cc127a7.exe	33
PID 1712 wrote to memory of 1964	1712	0bb1c29f4a8c046e798cd9781cc127a7.exe	33
PID 1712 wrote to memory of 1964	1712	0bb1c29f4a8c046e798cd9781cc127a7.exe	33
PID 1712 wrote to memory of 1964	1712	0bb1c29f4a8c046e798cd9781cc127a7.exe	33

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Fox.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Fox.exe

C:\Users\Admin\AppData\Local\Temp\0bb1c29f4a8c046e798cd9781cc127a7.exe
"C:\Users\Admin\AppData\Local\Temp\0bb1c29f4a8c046e798cd9781cc127a7.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JacGDBJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE244.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1660
- C:\Users\Admin\AppData\Local\Temp\0bb1c29f4a8c046e798cd9781cc127a7.exe
  "{path}"
  2⤵
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    - outlook_win_path
    PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab23A9.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar23DB.tmp

Filesize
95KB

MD5
34b43f8ae571926950496ea94c183aec

SHA1
c0897a8ad7f5ee50a04275370a04764996d46a29

SHA256
efef93be71f541b1121b192527765bf098f1724b3781bd4c9fa5296edbb52849

SHA512
d191023cf4b5141b22ea15b0098008c8d1e91de3179c1ae00a8ea22a60ff264cfdc9f0d2e73c68086957eb076b982481526831310e093a996b6ea53ce9ee3e74

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE244.tmp

Filesize
1KB

MD5
12327b566a0aabb17217e8c6d527f677

SHA1
9ff043645407417f63e0cb8d805bcb00a10e22d5

SHA256
08eeb2b79f5bfa4051828a8e45546bc2c3292c0daec1ea9e8ca3266fda563066

SHA512
b83f8c8e1336c361b7266d3520f923f95c0d965655bff784c98726a6ffae72360784ef2cc69dcefd7fa36fb2e7082401fb6cb2ad2b1b72fa489e3d641397836b

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\TEMPLA~1\Y3AESD~1.ZIP

Filesize
285KB

MD5
40a9752d59f2883e40d928f85a749008

SHA1
c60fb58eff64a7969b46f3934766f991352eeb47

SHA256
ef95540ec8dae3d255439fb847d26397c265b5cccda5ed0d6b9ed3dda14a2820

SHA512
ce33985f91103315accb1039635488d7e144df264bab8e164c1f9844ce6923e1c9c76349f14542901887ffcbbbca40b92cf474126f0b94893e8af1f608464b3c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files.zip

Filesize
24B

MD5
98a833e15d18697e8e56cdafb0642647

SHA1
e5f94d969899646a3d4635f28a7cd9dd69705887

SHA256
ff006c86b5ec033fe3cafd759bf75be00e50c375c75157e99c0c5d39c96a2a6c

SHA512
c6f9a09d9707b770dbc10d47c4d9b949f4ebf5f030b5ef8c511b635c32d418ad25d72eee5d7ed02a96aeb8bf2c85491ca1aa0e4336d242793c886ed1bcdd910b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files.zip

Filesize
93KB

MD5
5ed0afe8b89c0a1b9357c80d1cd83923

SHA1
f1ad1b91cb49d8627979eb7fae813010aea8861a

SHA256
0d55f21b10b2dccdbf2058332eab4cd7b96111664829c6522da320b0c7cf2126

SHA512
00f9e1b9d2c76c7a90ce17b4808e8337408cb1785f3c7ee4d4b54cfb1a12ad9f41b0ee6c3c4cf5e9f9c71b319a859f9b372fbd06fcac1dd2793c11cde71e16ca

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files\Are.docx

Filesize
11KB

MD5
a33e5b189842c5867f46566bdbf7a095

SHA1
e1c06359f6a76da90d19e8fd95e79c832edb3196

SHA256
5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

SHA512
f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files\CheckpointSplit.txt

Filesize
295KB

MD5
2bc396bcfd4954041b4c27825e871c28

SHA1
ab8a61d91e1c876ad3b23a84db536a9a0bbf1a31

SHA256
a207604b7b6135fc4d114ac51c916c35bc6ecbdbb26dc6187669afee5b78b284

SHA512
bd212cb8480f0eefd0305e7a351779eafa279e1d25721b6a593c4ae31c761f76a40749b916ca456460204e36b3ea104c2ae5ff3211533bdf7bf46404754a8db2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files\DenyDisconnect.doc

Filesize
123KB

MD5
7705302c983ce2b8659e17d8e8f08cde

SHA1
cdd60abc598430b9bac3cc7504a2eb300952d438

SHA256
ec30fdf94f5a99dd07f945dc8bc9b210da50dc3fef83c9ad4135deba8aaf61c1

SHA512
7ae0d1da103aad4375df79abfdfe6a7d72fe2ef123f5cfef2d31871710ef6df79a00ba1c5b19061a1eb35645034809e67ccfef4c5ba680c77d18caf73f4ebdd4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files\Files.docx

Filesize
11KB

MD5
4a8fbd593a733fc669169d614021185b

SHA1
166e66575715d4c52bcb471c09bdbc5a9bb2f615

SHA256
714cd32f8edacb3befbfc4b17db5b6eb05c2c8936e3bae14ea25a6050d88ae42

SHA512
6b2ebbbc34cd821fd9b3d7711d9cdadd8736412227e191883e5df19068f8118b7c80248eb61cc0a2f785a4153871a6003d79de934254b2c74c33b284c507a33b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files\FindResolve.docx

Filesize
470KB

MD5
1965167d6f08a58d7d1f7543f46c4e07

SHA1
8f7afda7be5aa0a39251685869a592b65caade31

SHA256
16a17b663f5c0944ec552c33654bdaa283137bb7388f6c947c2d788b38636f8e

SHA512
823abd30feb41ca271803999ba429c8a0d9b4d6d8783fe4047effbe8a29700eec3babf043ccbe8adf6a51d72f6d0425510c349ea9fa682a55b70015a385cf1f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files\InstallRestart.xlsm

Filesize
353KB

MD5
960595cf000022eb3aefc44ce4df0dc0

SHA1
5418b681aa8bbf31c4325ed21a58492893c5b0c3

SHA256
a7c5b9453e95997c417b46cf1911f09658d06634cd127d20cd622add50bd6b98

SHA512
f1a5e40053e98d93a23270e483abae2b76401e9af71c69951a81d96c29164820f6d95ee4446c1e83a1172c58348847a7cca151bae0d8c272ce70577c82781d95

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files\Opened.docx

Filesize
11KB

MD5
bfbc1a403197ac8cfc95638c2da2cf0e

SHA1
634658f4dd9747e87fa540f5ba47e218acfc8af2

SHA256
272ed278e82c84cf4f80f48ec7989e1fc35f2055d6d05b63c8a31880846597a6

SHA512
b8938526fcbf7152805aec130ca553e3ec949cb825430a5d0a25c90ec5eb0863857010484a4b31fdc4bb65a4c92ad7127c812b93114be4569a677f60debe43b1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files\Recently.docx

Filesize
11KB

MD5
3b068f508d40eb8258ff0b0592ca1f9c

SHA1
59ac025c3256e9c6c86165082974fe791ff9833a

SHA256
07db44a8d6c3a512b15f1cb7262a2d7e4b63ced2130bc9228515431699191cc7

SHA512
e29624bc8fecb0e2a9d917642375bd97b42502e5f23812195a61a4920cae5b6ed540e74dfcf8432dcceb7de906ad0501cdd68056f9b0ec86a6bb0c1e336bfe32

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files\RevokeGrant.docm

Filesize
132KB

MD5
f173487dbcfbd4ea5985042b07359656

SHA1
c872f6335a2c8edf7bafdde0e389cdd8b3e9e1ec

SHA256
21068c4d162dcc4af41235c8f306021d2029461a5e5d8a3d5a8a57d2b119a72b

SHA512
31a76a63bbf764ddfe66eb3a2fcdb73e1ad89631116e6ba4122f64cb842e90ff68b9d2f25fce7307d14fa3f61023d2439f894cd282d339fd3478a9f938749ebb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files\These.docx

Filesize
11KB

MD5
87cbab2a743fb7e0625cc332c9aac537

SHA1
50f858caa7f4ac3a93cf141a5d15b4edeb447ee7

SHA256
57e3b0d22fa619da90237d8bcf8f922b142c9f6abf47efc5a1f5b208c4d3f023

SHA512
6b678f0dd0030806effe6825fd52a6a30b951e0c3dcf91dfd7a713d387aa8b39ec24368e9623c463360acba5e929e268f75ce996526c5d4485894b8ac6b2e0fa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files\UnblockEdit.xlsm

Filesize
59KB

MD5
f3b0cd6a52b3b47d3a101f0a80c98b66

SHA1
7037183fd39e76a86e98b9a6f6b8b2ed320a8961

SHA256
adda3c1a30fc64560c8736344e491c3243dac28fc4e1df717b80a003ba200ec8

SHA512
817b2f1e58ef1c6f3480b7836eb3e4bb6cfe2b61956aeeb3ad8dfb911f1139cd7a6847a4c961d669e8c9a561593e970f560c25a7a824a859617a8585461ba061

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Files\UnpublishAssert.xlsm

Filesize
23KB

MD5
5ebf2dd65c37cb9b86692f0d266f9d9a

SHA1
3d432cf1e6faedaa8d856fe788e08f53c924d1db

SHA256
0794dedbf33d0e8f04c229a5330a63410bdea640806eb21bafd3c7be1fdafa8e

SHA512
df8b2f20c9f034bf8b28752612bd123443961df5076dba74bf9a6dcbafbaf6d8070caac2ff6f0dcc16281a7a3e42d99743827b4d05d923fd6e3624a826e4a372

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\NET4\Fox.exe

Filesize
689KB

MD5
91b41651e6e9ab352805c6d35a297d08

SHA1
11b8eaa7b7941461bc952b11ec3f07d25dcd1c2e

SHA256
0872abe29cc9231cdded3a44e02a7ea17f09cf2ac2bdbd7077065858829c3723

SHA512
b0b0d73f6ac7b6e9b39db0fa58931873143f6559c3b8d3db2d82d453045f75da94f3236b6c6c5200b52af6cacc038565eb2e9c6a834608dac0b0e8bb45b1e892

Download Submit
memory/1712-12-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1712-192-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1712-193-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/1712-19-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1712-17-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1712-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1712-13-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1712-97-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/1712-11-0x0000000000400000-0x000000000045F000-memory.dmp

Filesize
380KB

Download
memory/1964-57-0x000007FEF6280000-0x000007FEF6C6C000-memory.dmp

Filesize
9.9MB

Download
memory/1964-54-0x000007FEF6280000-0x000007FEF6C6C000-memory.dmp

Filesize
9.9MB

Download
memory/1964-53-0x0000000000CF0000-0x0000000000DA2000-memory.dmp

Filesize
712KB

Download
memory/1964-55-0x000000001B1F0000-0x000000001B270000-memory.dmp

Filesize
512KB

Download
memory/2408-0-0x0000000000B60000-0x0000000000C42000-memory.dmp

Filesize
904KB

Download
memory/2408-6-0x0000000008100000-0x00000000081BE000-memory.dmp

Filesize
760KB

Download
memory/2408-5-0x0000000005080000-0x00000000050C0000-memory.dmp

Filesize
256KB

Download
memory/2408-4-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/2408-3-0x0000000000490000-0x0000000000498000-memory.dmp

Filesize
32KB

Download
memory/2408-2-0x0000000005080000-0x00000000050C0000-memory.dmp

Filesize
256KB

Download
memory/2408-1-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download
memory/2408-7-0x0000000005010000-0x0000000005082000-memory.dmp

Filesize
456KB

Download
memory/2408-21-0x0000000074D40000-0x000000007542E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads