metasploit | 62c2cc068a664f5357ec867d83ff772c55cb8426f7ce7bf2636957bbd449b36f

Analysis

max time kernel
137s
max time network
120s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 21:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3df80296b4ab0962ac6611792ccbd07f.exe
Size

1.2MB
MD5

3df80296b4ab0962ac6611792ccbd07f
SHA1

16122e7c3fcb9f78237873277e015981cdcce3c7
SHA256

62c2cc068a664f5357ec867d83ff772c55cb8426f7ce7bf2636957bbd449b36f
SHA512

045e740df67bf820e25979a153d0f04ff1f15a08c52668e0fe5f4aa01d238fe534dab56a43f88a24e060ce9ad4ea18d96133812d6db20a8dccf50d99de86ba5c
SSDEEP

3072:SjyCCyz8K7mI0X1sawfXSh7q/ZwEKYSP+HMpC42mPZud/OMLZCdkRc3EHgyj3:2yC99KvH5Vq/tKvwXnOMLZCpC

Score

10^/10

metasploit backdoor evasion trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/fnstenv_mov

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Modifies security service 2 TTPs 20 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4"	regedit.exe

Executes dropped EXE 10 IoCs

pid	Process
2304	msxdll.exe
2816	msxdll.exe
2436	msxdll.exe
2620	msxdll.exe
2016	msxdll.exe
2184	msxdll.exe
1936	msxdll.exe
2824	msxdll.exe
2708	msxdll.exe
1640	msxdll.exe

Loads dropped DLL 20 IoCs

pid	Process
2480	3df80296b4ab0962ac6611792ccbd07f.exe
2480	3df80296b4ab0962ac6611792ccbd07f.exe
2304	msxdll.exe
2304	msxdll.exe
2816	msxdll.exe
2816	msxdll.exe
2436	msxdll.exe
2436	msxdll.exe
2620	msxdll.exe
2620	msxdll.exe
2016	msxdll.exe
2016	msxdll.exe
2184	msxdll.exe
2184	msxdll.exe
1936	msxdll.exe
1936	msxdll.exe
2824	msxdll.exe
2824	msxdll.exe
2708	msxdll.exe
2708	msxdll.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msxdll.exe	3df80296b4ab0962ac6611792ccbd07f.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	3df80296b4ab0962ac6611792ccbd07f.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File created	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe
File opened for modification	C:\Windows\SysWOW64\msxdll.exe	msxdll.exe

Runs .reg file with regedit 10 IoCs

pid	Process
3028	regedit.exe
1496	regedit.exe
1604	regedit.exe
2996	regedit.exe
2260	regedit.exe
1308	regedit.exe
2996	regedit.exe
2508	regedit.exe
1684	regedit.exe
2900	regedit.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 2136	2480	3df80296b4ab0962ac6611792ccbd07f.exe	28
PID 2480 wrote to memory of 2136	2480	3df80296b4ab0962ac6611792ccbd07f.exe	28
PID 2480 wrote to memory of 2136	2480	3df80296b4ab0962ac6611792ccbd07f.exe	28
PID 2480 wrote to memory of 2136	2480	3df80296b4ab0962ac6611792ccbd07f.exe	28
PID 2136 wrote to memory of 2996	2136	cmd.exe	29
PID 2136 wrote to memory of 2996	2136	cmd.exe	29
PID 2136 wrote to memory of 2996	2136	cmd.exe	29
PID 2136 wrote to memory of 2996	2136	cmd.exe	29
PID 2480 wrote to memory of 2304	2480	3df80296b4ab0962ac6611792ccbd07f.exe	30
PID 2480 wrote to memory of 2304	2480	3df80296b4ab0962ac6611792ccbd07f.exe	30
PID 2480 wrote to memory of 2304	2480	3df80296b4ab0962ac6611792ccbd07f.exe	30
PID 2480 wrote to memory of 2304	2480	3df80296b4ab0962ac6611792ccbd07f.exe	30
PID 2304 wrote to memory of 2880	2304	msxdll.exe	31
PID 2304 wrote to memory of 2880	2304	msxdll.exe	31
PID 2304 wrote to memory of 2880	2304	msxdll.exe	31
PID 2304 wrote to memory of 2880	2304	msxdll.exe	31
PID 2304 wrote to memory of 2816	2304	msxdll.exe	32
PID 2304 wrote to memory of 2816	2304	msxdll.exe	32
PID 2304 wrote to memory of 2816	2304	msxdll.exe	32
PID 2304 wrote to memory of 2816	2304	msxdll.exe	32
PID 2816 wrote to memory of 1312	2816	msxdll.exe	34
PID 2816 wrote to memory of 1312	2816	msxdll.exe	34
PID 2816 wrote to memory of 1312	2816	msxdll.exe	34
PID 2816 wrote to memory of 1312	2816	msxdll.exe	34
PID 1312 wrote to memory of 2260	1312	cmd.exe	33
PID 1312 wrote to memory of 2260	1312	cmd.exe	33
PID 1312 wrote to memory of 2260	1312	cmd.exe	33
PID 1312 wrote to memory of 2260	1312	cmd.exe	33
PID 2816 wrote to memory of 2436	2816	msxdll.exe	35
PID 2816 wrote to memory of 2436	2816	msxdll.exe	35
PID 2816 wrote to memory of 2436	2816	msxdll.exe	35
PID 2816 wrote to memory of 2436	2816	msxdll.exe	35
PID 2436 wrote to memory of 1800	2436	msxdll.exe	37
PID 2436 wrote to memory of 1800	2436	msxdll.exe	37
PID 2436 wrote to memory of 1800	2436	msxdll.exe	37
PID 2436 wrote to memory of 1800	2436	msxdll.exe	37
PID 1800 wrote to memory of 3028	1800	cmd.exe	36
PID 1800 wrote to memory of 3028	1800	cmd.exe	36
PID 1800 wrote to memory of 3028	1800	cmd.exe	36
PID 1800 wrote to memory of 3028	1800	cmd.exe	36
PID 2436 wrote to memory of 2620	2436	msxdll.exe	40
PID 2436 wrote to memory of 2620	2436	msxdll.exe	40
PID 2436 wrote to memory of 2620	2436	msxdll.exe	40
PID 2436 wrote to memory of 2620	2436	msxdll.exe	40
PID 2620 wrote to memory of 2604	2620	msxdll.exe	41
PID 2620 wrote to memory of 2604	2620	msxdll.exe	41
PID 2620 wrote to memory of 2604	2620	msxdll.exe	41
PID 2620 wrote to memory of 2604	2620	msxdll.exe	41
PID 2604 wrote to memory of 1308	2604	cmd.exe	42
PID 2604 wrote to memory of 1308	2604	cmd.exe	42
PID 2604 wrote to memory of 1308	2604	cmd.exe	42
PID 2604 wrote to memory of 1308	2604	cmd.exe	42
PID 2620 wrote to memory of 2016	2620	msxdll.exe	43
PID 2620 wrote to memory of 2016	2620	msxdll.exe	43
PID 2620 wrote to memory of 2016	2620	msxdll.exe	43
PID 2620 wrote to memory of 2016	2620	msxdll.exe	43
PID 2016 wrote to memory of 572	2016	msxdll.exe	45
PID 2016 wrote to memory of 572	2016	msxdll.exe	45
PID 2016 wrote to memory of 572	2016	msxdll.exe	45
PID 2016 wrote to memory of 572	2016	msxdll.exe	45
PID 572 wrote to memory of 1496	572	cmd.exe	44
PID 572 wrote to memory of 1496	572	cmd.exe	44
PID 572 wrote to memory of 1496	572	cmd.exe	44
PID 572 wrote to memory of 1496	572	cmd.exe	44

C:\Users\Admin\AppData\Local\Temp\3df80296b4ab0962ac6611792ccbd07f.exe
"C:\Users\Admin\AppData\Local\Temp\3df80296b4ab0962ac6611792ccbd07f.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c c:\a.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\regedit.exe
    REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
    3⤵
    - Modifies security service
    - Runs .reg file with regedit
    PID:2996
- C:\Windows\SysWOW64\msxdll.exe
  C:\Windows\system32\msxdll.exe 500 "C:\Users\Admin\AppData\Local\Temp\3df80296b4ab0962ac6611792ccbd07f.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c c:\a.bat
    3⤵
    PID:2880
- - C:\Windows\SysWOW64\msxdll.exe
    C:\Windows\system32\msxdll.exe 536 "C:\Windows\SysWOW64\msxdll.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c c:\a.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1312
    - - C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        5⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2900
  - - C:\Windows\SysWOW64\msxdll.exe
      C:\Windows\system32\msxdll.exe 540 "C:\Windows\SysWOW64\msxdll.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2436
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1800
    - - C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 544 "C:\Windows\SysWOW64\msxdll.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2620
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        7⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1308
      - C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 548 "C:\Windows\SysWOW64\msxdll.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:572
        
        C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 556 "C:\Windows\SysWOW64\msxdll.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2184
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        8⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        9⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2996
        
        C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 552 "C:\Windows\SysWOW64\msxdll.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1936
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        9⤵
        
        PID:812
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        10⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:2508
        
        C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 560 "C:\Windows\SysWOW64\msxdll.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        10⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        11⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1684
        
        C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 564 "C:\Windows\SysWOW64\msxdll.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2708
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        11⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\msxdll.exe
        
        C:\Windows\system32\msxdll.exe 572 "C:\Windows\SysWOW64\msxdll.exe"
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1640
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd /c c:\a.bat
        12⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\regedit.exe
        
        REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
        13⤵
        Modifies security service
        Runs .reg file with regedit
        
        PID:1604

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Modifies security service
- Runs .reg file with regedit
PID:2260

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Modifies security service
- Runs .reg file with regedit
PID:3028

C:\Windows\SysWOW64\regedit.exe
REGEDIT /S C:\Users\Admin\AppData\Local\Temp\1.reg
1⤵
- Modifies security service
- Runs .reg file with regedit
PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
9e5db93bd3302c217b15561d8f1e299d

SHA1
95a5579b336d16213909beda75589fd0a2091f30

SHA256
f360fb5740172b6b4dd59c1ac30b480511665ae991196f833167e275d91f943e

SHA512
b5547e5047a3c43397ee846ff9d5979cba45ba44671db5c5df5536d9dc26262e27a8645a08e0cf35960a3601dc0f6f5fe8d47ae232c9ca44d6899e97d36fb25a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
298B

MD5
4117e5a9c995bab9cd3bce3fc2b99a46

SHA1
80144ccbad81c2efb1df64e13d3d5f59ca4486da

SHA256
37b58c2d66ab2f896316ee0cdba30dcc9aac15a51995b8ba6c143c8ba34bf292

SHA512
bdb721bd3dea641a9b1f26b46311c05199de01c6b0d7ea2b973aa71a4f796b292a6964ddef32ba9dfc4a545768943d105f110c5d60716e0ff6f82914affb507c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
849B

MD5
558ce6da965ba1758d112b22e15aa5a2

SHA1
a365542609e4d1dc46be62928b08612fcabe2ede

SHA256
c11beaac10a5e00391ef4b41be8c240f59c5a2dc930aead6d7db237fcd2641fb

SHA512
37f7f10c3d201b11cc5224ae69c5990eb33b4430c601d3c21f6bec9323621120442e0cfa49e1f4eda459ea4ac750277e446dca78b9e44c1445bd891e4e460b5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
3KB

MD5
d085cde42c14e8ee2a5e8870d08aee42

SHA1
c8e967f1d301f97dbcf252d7e1677e590126f994

SHA256
a15d5dfd655de1214e0aae2292ead17eef1f1b211d39fac03276bbd6325b0d9f

SHA512
de2cebd45d3cf053df17ae43466db6a8b2d816bf4b9a8deb5b577cfedf765b5dcdc5904145809ad3ca03ccff308f8893ec1faa309dd34afcab7cc1836d698d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
b9dc88ed785d13aaeae9626d7a26a6a0

SHA1
ab67e1c5ca09589b93c06ad0edc4b5a18109ec1e

SHA256
9f1cba2944ed1a547847aa72ba5c759c55da7466796389f9a0f4fad69926e6fc

SHA512
df6380a3e5565ff2bc66d7589af7bc3dcfa2598212c95765d070765341bba446a5a5d6206b50d860f6375c437622deb95a066440145a1b7917aee6dcef207b91

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
386B

MD5
4be01c629881eddccb675ba267a66899

SHA1
23324e7814bcd157b27e810f4c786b0c39bfc9b1

SHA256
39c14522925e5e55bf1eefcd5beb8b7aae687158163082aac7ef5690c3524a30

SHA512
7c3063badaa57e3a39eea5d87e6bdbeec00793f9afd2bea52d3aa354e0bbd83e2a63966438fe7305f29a0ee6f45cb77d4613fe2d3b4f6719e16860deae764d55

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
978B

MD5
2e2266221550edce9a27c9060d5c2361

SHA1
f39f2d8f02f8b3a877d5969a81c4cb12679609f3

SHA256
e19af90814641d2c6cd15a7a53d676a4a7f63b4a80a14126824d1e63fdccdcdb

SHA512
e962cc55d1f9537159c34349a2fa5ffffc910de3e52cafa8347c43eded78b8e986ecb8e2e9ada5e2381b034151f17e6b984c279460e8e114e50ea58a64648864

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
300B

MD5
9e1df6d58e6c905e4628df434384b3c9

SHA1
e67dd641da70aa9654ed24b19ed06a3eb8c0db43

SHA256
25bb4f644e47b4b64b0052ec7edfd4c27f370d07ef884078fea685f30b9c1bb0

SHA512
93c9f24dc530e08c85776955c200be468d099d8f1d2efe5e20cbb3a1d803fe23e0ba9b589df2498832082a283d79f6f1053a26d15f49e31a0da395ecc7225ad3

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
476B

MD5
a5d4cddfecf34e5391a7a3df62312327

SHA1
04a3c708bab0c15b6746cf9dbf41a71c917a98b9

SHA256
8961a4310b2413753851ba8afe2feb4c522c20e856c6a98537d8ab440f48853a

SHA512
48024549d0fcb88e3bd46f7fb42715181142cae764a3daeb64cad07f10cf3bf14153731aeafba9a191557e29ddf1c5b62a460588823df215e2246eddaeff6643

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
8a36f3bf3750851d8732b132fa330bb4

SHA1
1cb36be31f3d7d9439aac14af3d7a27f05a980eb

SHA256
5d88aebc1d13a61609ef057cb38dc9d7b0a04a47a7670a7591f40d1ea05b6ad9

SHA512
a822885389f3b12baed60b565646bed97aea1740e163e236ca3647fb63a9c15f6e21bc5ff92eb2d47bb6b1268c71ffb8e5e84006f3c04377d9d3a7c16434e646

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.reg

Filesize
2KB

MD5
5575ef034e791d4d3b09da6c0c4ee764

SHA1
50a0851ddf4b0c4014ad91f976e953baffe30951

SHA256
9697ec584ef188873daa789eb779bb95dd3efa2c4c98a55dffa30cac4d156c14

SHA512
ecf52614d3a16d8e558751c799fde925650ef3e6d254d172217e1b0ed76a983d45b74688616d3e3432a16cec98b986b17eaecd319a18df9a67e4d47f17380756

Download Submit
C:\Windows\SysWOW64\msxdll.exe

Filesize
514KB

MD5
b3e018e2135fd014f9cf8c8889028730

SHA1
7198eff5eb8942c2de1eeb6a026a001f5fb279f2

SHA256
f04e2f413e3e4e64bdef6ee3687faa5bf84f0b06df546273fb1bc5be83917cb5

SHA512
f3598cfed029d4bd13757475c9179d7e9ffb9bdbc003bc6a5937e4c0d90de2642bb4aedf9b8ba8e22925b3793ed8bfed93f774a267764b14018e2b01453df90f

Download Submit
C:\Windows\SysWOW64\msxdll.exe

Filesize
1.1MB

MD5
38cdce69b94735287a77fc18285e3787

SHA1
75bc3c8f362a2247e4fe82b14f8aa5a478b6e060

SHA256
8d4573856f4b782cd89379847fd99c1b10abbde2056939c73f6b7c63153c8933

SHA512
035768253495225bd7d1a8796d1be4f99437e05eaa6c819ddd7c403500758644c63848b95a6d1b0baff2527a00e06ff29572df13fffcb4a3112c058b93ecb320

Download Submit
C:\Windows\SysWOW64\msxdll.exe

Filesize
897KB

MD5
b41cb3735112df7ee7b77908d1d7544a

SHA1
6fa9e1c45b21e9abf24b6db630be814d6481c599

SHA256
de0e548eb0451efd8976cf0531eb86214ac0d8b3c583004bcd951baa08cdf415

SHA512
c5133881e126de8ef2379a5155feb912c06de64005deacd377563ead7c624c8e0167fda4f89a70d2bb60c8d1fe3aebdd6764193336e5816d8e5d04ca29b077b5

Download Submit
C:\Windows\SysWOW64\msxdll.exe

Filesize
1.1MB

MD5
8e3d554f7b5040c6b8aa2c59437ec46d

SHA1
da9388ce635c34292e8a0a207828d211522b0649

SHA256
28d223b0ed88e6b8f395141bd3af4ab41ce7f169b4343ce352eab46a1818256e

SHA512
e09fcc8dbaaad3e66fe0eef75c7de4138ee73ce00fe49c9972fc7b2cee9e523231f1196d9871fd25c7f60c24d3f60c6b6c7e06d2501cfd473cdf23349b954fc3

Download Submit
C:\Windows\SysWOW64\msxdll.exe

Filesize
193KB

MD5
5e05d6923f39dbef9661a164403234a4

SHA1
4a620248a7f1cb937843e4e8e2f00cc7acc1d5a1

SHA256
9b7a2a1d4c19e2ed8a2f24bbee682850458e41775ab4a4624926cda22b7c1f5e

SHA512
cb39f6373815f9626b29ed888d63affb19e37b8efa7a1e4bdd5dca27f18986046851ce2ba8192f875c2cae4fac8a82ff1158ae4975e5c86f3d3c6ca7c91470d8

Download Submit
C:\Windows\SysWOW64\msxdll.exe

Filesize
119KB

MD5
0611ddc0bff6447b0a7b4b9c82e84bcc

SHA1
c65f26f07e0246f15f6c80b0d697dae74237ff45

SHA256
ef9970016dfca623e3363173d065584a06048b158969b447ab07b4ef82a72482

SHA512
e0fa1407716110652c7736c866945485c3bb8db49d784b8572d0bf9430c7a84e9af7179dcc2ea16ff549b5b9ae1a21cdc5b2a99c6854499232e2ee589ac353b2

Download Submit
C:\a.bat

Filesize
5KB

MD5
0019a0451cc6b9659762c3e274bc04fb

SHA1
5259e256cc0908f2846e532161b989f1295f479b

SHA256
ce4674afd978d1401596d22a0961f90c8fb53c5bd55649684e1a999c8cf77876

SHA512
314c23ec37cb0cd4443213c019c4541df968447353b422ef6fff1e7ddf6c983c80778787408b7ca9b81e580a6a7f1589ca7f43c022e6fc16182973580ed4d904

Download Submit
\Windows\SysWOW64\msxdll.exe

Filesize
704KB

MD5
e5e541a6ea8d1f4e92828efca9b5f19c

SHA1
57843e8b0818acc4a774ad902c9a0dfe2be6bcaa

SHA256
a3658738deb446d49d1464d6590444d64feee7fd002915edad428c908772421c

SHA512
5fabe7e4ff898d36072bd7d83684db796b06fdcfc3899e400e57fad75a8849b57585ffa7b81a1310920b62e17a0c762e6b6db4ce3e6babca2805824ed8276d75

Download Submit
\Windows\SysWOW64\msxdll.exe

Filesize
1.2MB

MD5
3df80296b4ab0962ac6611792ccbd07f

SHA1
16122e7c3fcb9f78237873277e015981cdcce3c7

SHA256
62c2cc068a664f5357ec867d83ff772c55cb8426f7ce7bf2636957bbd449b36f

SHA512
045e740df67bf820e25979a153d0f04ff1f15a08c52668e0fe5f4aa01d238fe534dab56a43f88a24e060ce9ad4ea18d96133812d6db20a8dccf50d99de86ba5c

Download Submit
\Windows\SysWOW64\msxdll.exe

Filesize
1.1MB

MD5
c23e8c45f910000162904f76b00737f5

SHA1
f9dafa19f18fa7013fafad8d8f2e257890e557a8

SHA256
f94eda45e096c431b3dcef9ffb4f48c69ffca4365958e7603322eb739cc7bd36

SHA512
3822e7435aa5bed5eb9c19d82301fcf8d32aec2c375bd1d1d6dbc44fb4fa47497ef29c1c5ce6b3c61c2fbca96ca9e3a3846935e52bd2c7594b758f20cf59180b

Download Submit
\Windows\SysWOW64\msxdll.exe

Filesize
384KB

MD5
b930503e0114448b20463969acaa4a1f

SHA1
4ab0495fd300e2d35b646f6cc32eedd571b79297

SHA256
7eb78166ab1f656b73a35f318087dbe30e039bfa4aa46146c19d98efc0dfc85c

SHA512
8efd033e1e7a7d4c5d3d24f455478f241b7dbbfbd238a40e2a93b2fb41d32a374cedcdc32590c954dea3e264b3ebee8ea3fc828afb0cf82817a8acb1c7b3ffe8

Download Submit
\Windows\SysWOW64\msxdll.exe

Filesize
209KB

MD5
4a08840075a390cb36ab9bd9bd9c8a8c

SHA1
514919de34ea27cdc903d9337ea8b0dfb081571e

SHA256
629118369d07a6755aac703a58c01cb30441380fcca82d9fa50e76574c6b9467

SHA512
61546e28ee2ff2b63c8473d8f87b520a51d386c4a9de83eb127cb095e459e89f6c70e7ab9fe05ad1521a9a0cf9a8c467c4f4a7e906c8afdf0a081bd39d72d8df

Download Submit
\Windows\SysWOW64\msxdll.exe

Filesize
1.0MB

MD5
3109107289650720c7e1a013a31ab5f9

SHA1
1128f898c4b39d6362a718918440607cf2887b67

SHA256
ed0cb3ed19adb458ef11872916af3424bc2c718395fdb308c900505b0fe3d295

SHA512
6a23f01abd51fe44a78d4d22ae07fe0f35f0ca2874d613a97c341cdcf2bc2da9db54622249f8f3c5b00c7c8b996865dd620faed02a55879c42dc0ba2cb970018

Download Submit
\Windows\SysWOW64\msxdll.exe

Filesize
1024KB

MD5
be782c2ecee31c21ebc37532757f353e

SHA1
27d616cb1f08deda823d344532442c50c1482fd7

SHA256
bb4f42a891d2fb3d2223341cebb35084530e1a92cf1ead7bfb03fb9c200c0de6

SHA512
1cbae4aa9faff191adc2d16477770a954f6c5f203c402146c662ca4a47888983881e16052bec6b7fa8383ee9814dc0c02aeb455e7576583ce3021dc24aa9c786

Download Submit
memory/1640-1101-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/1936-742-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/1936-970-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2016-502-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2016-731-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2184-622-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2304-141-0x0000000002930000-0x0000000002A5F000-memory.dmp

Filesize
1.2MB

Download
memory/2304-144-0x0000000002930000-0x0000000002A5F000-memory.dmp

Filesize
1.2MB

Download
memory/2304-128-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2436-491-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2480-127-0x00000000029B0000-0x0000000002ADF000-memory.dmp

Filesize
1.2MB

Download
memory/2480-1-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2480-130-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2480-126-0x00000000029B0000-0x0000000002ADF000-memory.dmp

Filesize
1.2MB

Download
memory/2620-611-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2620-382-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2708-981-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2708-1210-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2816-371-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2816-253-0x00000000028E0000-0x0000000002A0F000-memory.dmp

Filesize
1.2MB

Download
memory/2816-250-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2824-861-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download
memory/2824-1090-0x0000000000400000-0x000000000052F000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads