95b9b425ba1ba1a3033854240482ebafbe574717fe656b6642e13a29acdf683b

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2be023437c9ac2ee5cf5ff59f2755695.exe
Size

121KB
MD5

2be023437c9ac2ee5cf5ff59f2755695
SHA1

fce23cea7072b64f26e93c4d22e110313e373c45
SHA256

95b9b425ba1ba1a3033854240482ebafbe574717fe656b6642e13a29acdf683b
SHA512

3a0a6c0a88466eed5facb3ff19e33fc302e7c0e7d09595001df7261a63bb3507eb70b98c2ba1d5aea6c23d4fa4146b5daf0292954550093146f072822c553cf5
SSDEEP

3072:QCbOc4Mx4WckUmgAsOxIYcNmqr5pHkDdKblcd8A5RxfF70H5:Q9qxf+ArxIYgrHgKRcN5RxN70H5

Score

8^/10

evasion persistence trojan upx

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	LSASS.EXE

Executes dropped EXE 7 IoCs

pid	Process
2716	Setup.exe
3056	ntfsus.exe
2780	LSASS.EXE
532	SMSS.EXE
2128	SMSS.EXE
1492	SMSS.EXE
2424	SMSS.EXE

Loads dropped DLL 29 IoCs

pid	Process
2304	2be023437c9ac2ee5cf5ff59f2755695.exe
2716	Setup.exe
2716	Setup.exe
2716	Setup.exe
2576	regsvr32.exe
2716	Setup.exe
2716	Setup.exe
2780	LSASS.EXE
2780	LSASS.EXE
2780	LSASS.EXE
2780	LSASS.EXE
2780	LSASS.EXE
3056	ntfsus.exe
532	SMSS.EXE
532	SMSS.EXE
532	SMSS.EXE
532	SMSS.EXE
2964	cmd.exe
2964	cmd.exe
2128	SMSS.EXE
2128	SMSS.EXE
2308	cmd.exe
2308	cmd.exe
1492	SMSS.EXE
1492	SMSS.EXE
344	cmd.exe
344	cmd.exe
2424	SMSS.EXE
2424	SMSS.EXE

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2304-0-0x0000000000400000-0x0000000000423000-memory.dmp	upx
behavioral1/memory/2304-76-0x0000000000400000-0x0000000000423000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents	Setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	Setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS	Setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI	Setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL	Setup.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService	ntfsus.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Setup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LSASS.EXE

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	LSASS.EXE

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\E:\AUTORUN.INF	LSASS.EXE
File opened for modification	C:\AUTORUN.INF	LSASS.EXE
File created	C:\AUTORUN.INF	LSASS.EXE
File opened for modification	D:\AUTORUN.INF	LSASS.EXE

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dnsq.dll	ntfsus.exe
File opened for modification	C:\Windows\SysWOW64\com\LSASS.EXE	Setup.exe
File opened for modification	C:\Windows\SysWOW64\com\SMSS.EXE	LSASS.EXE
File created	C:\Windows\SysWOW64\com\netcfg.dll	ntfsus.exe
File opened for modification	C:\Windows\SysWOW64\com\netcfg.dll	ntfsus.exe
File created	C:\Windows\SysWOW64\com\netcfg.000	ntfsus.exe
File created	C:\Windows\SysWOW64\dnsq.dll	ntfsus.exe
File opened for modification	C:\Windows\SysWOW64\com\bak	LSASS.EXE
File created	C:\Windows\SysWOW64\com\SMSS.EXE	Setup.exe
File opened for modification	C:\Windows\SysWOW64\com\netcfg.000	ntfsus.exe
File created	C:\Windows\SysWOW64\com\LSASS.EXE	Setup.exe
File opened for modification	C:\Windows\SysWOW64\com\SMSS.EXE	Setup.exe
File opened for modification	C:\Windows\SysWOW64\com\LSASS.EXE	LSASS.EXE
File created	C:\Windows\SysWOW64\00302.log	ntfsus.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{250E1501-AC02-11EE-83C2-FA7D6BB1EAA3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000b663c655c766da46541d41de56a87c8ce945302755f1414732df996c29d709d4000000000e8000000002000020000000c3767259bff7fa7dd62708bed974b6fb4d6a8800f51f75b7576e74e9702cdb9a2000000028700226d911ce782d24fff8c18276eef21a586b2fdb928a3a76fb1c15744c1c400000000759e6cc20f676d290e30d428a20c1bc48ac8e11ccab7808b461bd6401a6a9b6174aa5489902cb80ca29906602b466b80b8b82b86c43447f8faffd85388699d7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a420ff0e40da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main	LSASS.EXE
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000aafc33427337fb866547eac3fb4f4374b2af1eb7e40e8dc60e11a4da93bf0148000000000e8000000002000020000000fb29773e2615ec71c14b8e34296bf7c6eeafd0a7702769b780ad4629d1a3cf5790000000403074dedce42521c8e595a587ec21f84c89238a1fa8d933291dbeeb8c910d7917a8afc749672bea3e3bf73bf73be1b13d7096da9048fd256f29c7528135ee2dee193063e2b44b48b542d6af4582e4a2aae80c05e5984dc69dd19117bc6196571b059754fe50c513f4a92f5d6b2e65d78bf9ca7a49dd0fd270631b931e8326f36af92f7708efd2caaba4e59b578fcad4400000005f7cb0e05a99f680362f98cdaf1ed34237ec0f68c26cc5c16fd2b901dd1a99e7ceb8331ec90295a6d99f991009343acd665a24bb0877226dbcf083d261071d51	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410645441"	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ = "IfObj Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\ = "{814293BA-8708-42E9-A6B7-1BD3172B9DDF}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\ = "ifObj ActiveX Control module"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ = "_DIfObj"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\ = "IfObj Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ = "_DIfObjEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\1\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\InprocServer32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ProgID\ = "IFOBJ.IfObjCtrl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\com\\netcfg.dll, 1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\FLAGS\ = "2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\ = "_DIfObj"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{450EC9C4-0F7F-407F-B084-D1147FE9DDCC}\ = "IfObj Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAC17985-187F-4457-A841-E60BAE6359C2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D96C4BF-8DCA-4A97-A24A-896FF841AE2D}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IFOBJ.IfObjCtrl.1\CLSID\ = "{D9901239-34A2-448D-A000-3705544ECE9D}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D9901239-34A2-448D-A000-3705544ECE9D}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{814293BA-8708-42E9-A6B7-1BD3172B9DDF}\1.0\0\win32	regsvr32.exe

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1200	ping.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	ntfsus.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
292	iexplore.exe

Suspicious use of SetWindowsHookEx 17 IoCs

pid	Process
2716	Setup.exe
2716	Setup.exe
2716	Setup.exe
2716	Setup.exe
3056	ntfsus.exe
3056	ntfsus.exe
2780	LSASS.EXE
2780	LSASS.EXE
2780	LSASS.EXE
2780	LSASS.EXE
3056	ntfsus.exe
292	iexplore.exe
292	iexplore.exe
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE
3052	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2304 wrote to memory of 2716	2304	2be023437c9ac2ee5cf5ff59f2755695.exe	20
PID 2304 wrote to memory of 2716	2304	2be023437c9ac2ee5cf5ff59f2755695.exe	20
PID 2304 wrote to memory of 2716	2304	2be023437c9ac2ee5cf5ff59f2755695.exe	20
PID 2304 wrote to memory of 2716	2304	2be023437c9ac2ee5cf5ff59f2755695.exe	20
PID 2304 wrote to memory of 2716	2304	2be023437c9ac2ee5cf5ff59f2755695.exe	20
PID 2304 wrote to memory of 2716	2304	2be023437c9ac2ee5cf5ff59f2755695.exe	20
PID 2304 wrote to memory of 2716	2304	2be023437c9ac2ee5cf5ff59f2755695.exe	20
PID 2716 wrote to memory of 2336	2716	Setup.exe	28
PID 2716 wrote to memory of 2336	2716	Setup.exe	28
PID 2716 wrote to memory of 2336	2716	Setup.exe	28
PID 2716 wrote to memory of 2336	2716	Setup.exe	28
PID 2716 wrote to memory of 2336	2716	Setup.exe	28
PID 2716 wrote to memory of 2336	2716	Setup.exe	28
PID 2716 wrote to memory of 2336	2716	Setup.exe	28
PID 2716 wrote to memory of 2676	2716	Setup.exe	26
PID 2716 wrote to memory of 2676	2716	Setup.exe	26
PID 2716 wrote to memory of 2676	2716	Setup.exe	26
PID 2716 wrote to memory of 2676	2716	Setup.exe	26
PID 2716 wrote to memory of 2676	2716	Setup.exe	26
PID 2716 wrote to memory of 2676	2716	Setup.exe	26
PID 2716 wrote to memory of 2676	2716	Setup.exe	26
PID 2716 wrote to memory of 1984	2716	Setup.exe	22
PID 2716 wrote to memory of 1984	2716	Setup.exe	22
PID 2716 wrote to memory of 1984	2716	Setup.exe	22
PID 2716 wrote to memory of 1984	2716	Setup.exe	22
PID 2716 wrote to memory of 1984	2716	Setup.exe	22
PID 2716 wrote to memory of 1984	2716	Setup.exe	22
PID 2716 wrote to memory of 1984	2716	Setup.exe	22
PID 2716 wrote to memory of 3056	2716	Setup.exe	27
PID 2716 wrote to memory of 3056	2716	Setup.exe	27
PID 2716 wrote to memory of 3056	2716	Setup.exe	27
PID 2716 wrote to memory of 3056	2716	Setup.exe	27
PID 2716 wrote to memory of 3056	2716	Setup.exe	27
PID 2716 wrote to memory of 3056	2716	Setup.exe	27
PID 2716 wrote to memory of 3056	2716	Setup.exe	27
PID 3056 wrote to memory of 2576	3056	ntfsus.exe	36
PID 3056 wrote to memory of 2576	3056	ntfsus.exe	36
PID 3056 wrote to memory of 2576	3056	ntfsus.exe	36
PID 3056 wrote to memory of 2576	3056	ntfsus.exe	36
PID 3056 wrote to memory of 2576	3056	ntfsus.exe	36
PID 3056 wrote to memory of 2576	3056	ntfsus.exe	36
PID 3056 wrote to memory of 2576	3056	ntfsus.exe	36
PID 3056 wrote to memory of 3032	3056	ntfsus.exe	38
PID 3056 wrote to memory of 3032	3056	ntfsus.exe	38
PID 3056 wrote to memory of 3032	3056	ntfsus.exe	38
PID 3056 wrote to memory of 3032	3056	ntfsus.exe	38
PID 3056 wrote to memory of 3032	3056	ntfsus.exe	38
PID 3056 wrote to memory of 3032	3056	ntfsus.exe	38
PID 3056 wrote to memory of 3032	3056	ntfsus.exe	38
PID 3032 wrote to memory of 2088	3032	net.exe	39
PID 3032 wrote to memory of 2088	3032	net.exe	39
PID 3032 wrote to memory of 2088	3032	net.exe	39
PID 3032 wrote to memory of 2088	3032	net.exe	39
PID 3032 wrote to memory of 2088	3032	net.exe	39
PID 3032 wrote to memory of 2088	3032	net.exe	39
PID 3032 wrote to memory of 2088	3032	net.exe	39
PID 2716 wrote to memory of 2172	2716	Setup.exe	41
PID 2716 wrote to memory of 2172	2716	Setup.exe	41
PID 2716 wrote to memory of 2172	2716	Setup.exe	41
PID 2716 wrote to memory of 2172	2716	Setup.exe	41
PID 2716 wrote to memory of 2172	2716	Setup.exe	41
PID 2716 wrote to memory of 2172	2716	Setup.exe	41
PID 2716 wrote to memory of 2172	2716	Setup.exe	41
PID 2716 wrote to memory of 1672	2716	Setup.exe	42

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1160	attrib.exe

C:\Users\Admin\AppData\Local\Temp\2be023437c9ac2ee5cf5ff59f2755695.exe
"C:\Users\Admin\AppData\Local\Temp\2be023437c9ac2ee5cf5ff59f2755695.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2304
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" C:\Windows\system32\com\SMSS.EXE /e /t /g Admin:F
    3⤵
    PID:1984
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" C:\Windows\system32\com\LSASS.EXE /e /t /g Admin:F
    3⤵
    PID:2676
- - C:\ntfsus.exe
    C:\ntfsus.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks for any installed AV software in registry
    - Drops file in System32 directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" C:\Windows\system32\com\netcfg.dll /s
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:2576
  - - C:\Windows\SysWOW64\net.exe
      net start
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3032
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start
        5⤵
        
        PID:2088
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c C:\ntfsus.exe.bat
      4⤵
      PID:852
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib -a -r -s -h "C:\ntfsus.exe"
        5⤵
        Views/modifies file attributes
        
        PID:1160
- - C:\Windows\SysWOW64\cacls.exe
    "C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F
    3⤵
    PID:2336
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c rd /s /q "C:\Windows\system32\com\netcfg.000"
    3⤵
    PID:2172
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c rd /s /q "C:\Windows\system32\com\netcfg.dll"
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\com\LSASS.EXE
    "C:\Windows\system32\com\LSASS.EXE"
    3⤵
    - Sets file execution options in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2780
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c rd /s /q "C:\Windows\system32\dnsq.dll"
      4⤵
      PID:1136
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c rd /s /q "C:\ntfsus.exe"
      4⤵
      PID:2404
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c rd /s /q "C:\Windows\system32\com\bak"
      4⤵
      PID:2384
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "C:\Windows\system32\com\SMSS.EXE C:\Windows\system32\com\LSASS.EXE^|E:\pagefile.pif"
      4⤵
      Loads dropped DLL
      PID:344
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "C:\Windows\system32\com\SMSS.EXE C:\Windows\system32\com\LSASS.EXE^|D:\pagefile.pif"
      4⤵
      Loads dropped DLL
      PID:2308
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c "C:\Windows\system32\com\SMSS.EXE C:\Windows\system32\com\LSASS.EXE^|C:\pagefile.pif"
      4⤵
      Loads dropped DLL
      PID:2964
  - - C:\Windows\SysWOW64\ping.exe
      ping.exe -f -n 1 www.baidu.com
      4⤵
      Runs ping.exe
      PID:1200
  - - \??\c:\program files\internet explorer\iexplore.exe
      http://w.c0mo.com/r.htm
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:292
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:292 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:3052

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\LSASS.EXE /e /t /g Admin:F
1⤵
PID:1904

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Windows\system32\com\netcfg.dll"
1⤵
PID:688

C:\Windows\SysWOW64\com\SMSS.EXE
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\~.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:532

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Windows\system32\com\netcfg.000"
1⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\ntfsus.exe"
1⤵
PID:1892

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c rd /s /q "C:\Windows\system32\com\SMSS.EXE"
1⤵
PID:1576

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com\SMSS.EXE /e /t /g Admin:F
1⤵
PID:2508

C:\Windows\SysWOW64\cacls.exe
"C:\Windows\System32\cacls.exe" C:\Windows\system32\com /e /t /g Admin:F
1⤵
PID:2228

C:\Windows\SysWOW64\com\SMSS.EXE
C:\Windows\system32\com\SMSS.EXE C:\Windows\system32\com\LSASS.EXE|E:\pagefile.pif
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424

C:\Windows\SysWOW64\com\SMSS.EXE
C:\Windows\system32\com\SMSS.EXE C:\Windows\system32\com\LSASS.EXE|D:\pagefile.pif
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492

C:\Windows\SysWOW64\com\SMSS.EXE
C:\Windows\system32\com\SMSS.EXE C:\Windows\system32\com\LSASS.EXE|C:\pagefile.pif
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
84b87060efae06f32823b33c64082a20

SHA1
d8a6994b756d8ec6f566e8b118aea1caaa9d1694

SHA256
fee1a9a9473033a459cd2c1e1a716fb069deac222da959b744f99a828700c845

SHA512
79c2bbb92b2e52e833881b34e1336f411cf393e3007436d96598949792150bbf38a4a74eda09406604b6cc0d1a45dfae6221063f7395a7c12cce2b0b12ef6513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d890b069adc9fe90cd731fb42a8acd5d

SHA1
21c68a2fd2f0377de3e87ff0e25a4304de026ec1

SHA256
f0e3eee383a3b99f342b49f6d63017b56b5a6952b543b17ff1fc22db18671618

SHA512
245d2312aa480176c03a8dc3a45707598bb9b2446c4bd017a535ca344eb821303c7cd1afe4b0aa90e86b256495ea6405ace5732661a16b726cfc1f34ecae95eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdbbb5b1a5b26f45955910ced69928fb

SHA1
96808dce53746e0704eeac1a6f47cd1a717e2f7e

SHA256
1e9860334b98226f7512ac12d9f216957c677b7269c5d0501b1ebef6b14a2ec0

SHA512
9926321ec2689602719d2d45d53d0ea2ac6a6a9662cd8891349cf13e1feb70df5b3b2ca8674fedc67dda093cb509d958ae43ba735c3ac7c2222922975dd45436

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
415584c92ac2c632fc28776f1060f3ca

SHA1
c07478b33e6f333722e8badaff9f1b0c070878c2

SHA256
f06045e253ec8608357b51c5fabac6dcf9a0368b6f8773bb99728b539e425c4f

SHA512
3a6b3e4899e8c56fc35ecbd6504b34d25c70519abbd178aebc00fa9c403d7798937f6fce937376273d5411a815077033ba95c7610536a5122adfa9af3a9201fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
92ee763be6f9cea9337cbca0b12c8873

SHA1
d0ff76fdab5a77f05a9a193600bf655131e3d472

SHA256
17c6e77fa14352a230e8dda2ce6d7eaf9d4034bd4add1843c2d7269aea1def27

SHA512
d1201b7c5e22965d0ad580db32db086d80f48a4a5c834fdedf206eaf33a4ee33cb54bca6e8d125f609df2572bb9208aa390c0d9d77ad591691b6c63e3b9ab2c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
53778beb20bae9cc1294d825ec84b34a

SHA1
971ad43ab7c190275a5b73742cfb072b0a44fc85

SHA256
20e866e2baa0138f8da99668ad222a0898bd39ad0779d45919b96e75741fc566

SHA512
499d5bed3124930f2096bbfa094fe5772db0baaa2cdb3ecbc0206249ddf80400d431bf2bdfe684314af5bf058d5af7d0f3fa6af64b0fabbd25869b139882f3f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12e2c45b79604477d1f59fc421902d1f

SHA1
8e77a8f4bf678e3f120009ceb5e4150e6c8aff26

SHA256
586871b06b3c0bfcac482ded9396fa77990c3e95a5e6636c65c75fed0de9d26a

SHA512
850621aa091d3ac28e4cab6b41f1ad8fa901125616311b4ab69e3c81948de63f594293b65f41c40468df680e7e2f86676bf139613e16ca5734aae2aec23323d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4a8a112449a749b3bbded6991a7273e

SHA1
d445a129ac284f7bc8a5d4fc7a3e8f3a3a6449a8

SHA256
1acebb665c4eb1b21e687af2b8857cda80a03473463bcf3d65bd2a1592213432

SHA512
062a41683fa9245ad2c8d86bcdbc2da1ecb09d45b3d8a643a75c260de87b4555c4cadeda45051709da8150b6163f03a9ae16ff5a718d97858c17cf0520a5e3a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7533300365319ba9690d6e9717515fb4

SHA1
a318d4ce89230e80e9864acb2227f303f897ed23

SHA256
0b6e14e22e0d622232121f232852e48aeaa3e44a2695f38b99a822abd5b56344

SHA512
af64a22d8f78deb28e01a884f07c53ffc87a90f9de01ea68c2439b403a6077c4bf52b51f92369ee47b0554b4b2fc9cbdc99ba1335aa8c9350e19a6db911aeba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2659120061ec2c12a0ad25cafebe1987

SHA1
67e82049ac734a12e327b57ea43a900d09da1673

SHA256
de6796677cae27554d8c9ed6ed7b6008583c0eeff224f065ee3b4247e1b61111

SHA512
16463ae93a35d294b351e7b99b3cd146fcf0874a2211bd69034225f07df3ac1d860205c022333a0e1ce60c1f668e1b4293cf0936ce72be8be48f875e8f216449

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d4d7fd2e7843d2c3ac0f21292a62a39e

SHA1
d15325507db2dccc3335e3dad68ff0efb8073c91

SHA256
d0d413643a15eb449116cc3182fb259f919d8dcb1b32edf42854caed62a38195

SHA512
7ce15c99fae67ff4b8860c29379be63ddb28d4f27f57ea5e0dd6257f09121da8faf08cefa9c48c8987a92ec6f2243300bb4d53b133514bcf4d884a234e82948d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ba70492875d9300692369871c8719b5

SHA1
12d6ab1901e49c0a5686e25882fae0bae2b75b1c

SHA256
4a0674f0ee6f13da3dc25d1c87c385c1ceddfbd7be8078374c4881e697148a3d

SHA512
6123eea801b70df6ee5832e664d7b6790c049cd8b1e131043028d1d999512f2ff3f5c4f9dff5569698d4eec98f2ebf5aa1d6a884ead9dd861510dc611ff45b35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2947cabd9bf37c87869dbb9e8ebe75dc

SHA1
9278cb55cf6bcac20c0a14df22c4a734d2e177c8

SHA256
d7c294b8e1826607173ffd675665c9d0cf00246137ff5aabe01fff26d10a591f

SHA512
d8210450d37a02483b3a77b921f1de18da03c1e2e42d0453cefab170cb1855a46e3a30d62a2e371deba0b34ba00600f8420c4dbbc5044c3cf3294c5163b5be33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fd92c2da6f2bc93f5d9138fd763495e6

SHA1
1e15f42a482fd826e3b26a835cabb1a4b42288d1

SHA256
97e704d38593215f854d2dc27f12ee262403fac44f4b53a37fd6c7417f340d46

SHA512
76c31c774f2061b398b558421af882d1b6cb25db919d33d0c9d29dc860c31823518f646bdfccef63b41fe7112dbbde1f4d069899bed6126ca62b51d22176de9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1EBDLS6\px[1].js

Filesize
346B

MD5
f84f931c0dd37448e03f0dabf4e4ca9f

SHA1
9c2c50edcf576453ccc07bf65668bd23c76e8663

SHA256
5c1d5fd46a88611c31ecbb8ffc1142a7e74ec7fb7d72bd3891131c880ef3f584

SHA512
afc3089d932fb030e932bf6414ac05681771051dd51d164f09635ca09cbd8525a52879524b6aa24e972e7766ddf529484cc1ec416de8b61255435a89ba781f8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14FA.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe

Filesize
92KB

MD5
60b46c60c90e04b78788bd459609d4fa

SHA1
5ce0804df09e653dbc80ac0611a38ec66559cbde

SHA256
8656c09f7010e608be4c25f71f0bdfdc7bb6096c07488e3bb1671a6f9f0b6e7b

SHA512
d315771d291f689e04f2e3ce1c5e649ab903aa5edf997d652409a87bd38a40b6fd308bffd401ae67e06988d28f1705141f22e7f7f19ade110d2b80e77ec6ef6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar15B8.tmp

Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
\Users\Admin\AppData\Local\Temp\RarSFX0\Setup.exe

Filesize
4KB

MD5
9fe4e127b4572f06e841a89c628bd0c3

SHA1
8a2ebf107a5e8c1643186e822f195f1bb2fa592e

SHA256
754d752c265f25b3a7400434885547fc6bdc24de28560153a4481da68c4db94d

SHA512
99f03eb1ac540a71d1c61c35638ec7cebbdfd4c1bdb071d3056b7aef4470e01b5697cd14f421349eb0ffcb3732eabe07eab1d84f003c07c564cfc57bbe66137d

Download Submit
memory/292-102-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download
memory/532-99-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/1492-92-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2128-85-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/2304-0-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2304-76-0x0000000000400000-0x0000000000423000-memory.dmp

Filesize
140KB

Download
memory/2304-1-0x00000000001D0000-0x00000000001F3000-memory.dmp

Filesize
140KB

Download
memory/2304-2-0x00000000001D0000-0x00000000001F3000-memory.dmp

Filesize
140KB

Download
memory/2424-98-0x0000000000400000-0x000000000040B000-memory.dmp

Filesize
44KB

Download
memory/3056-74-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads