ef99a1844cbf354868a70cdcc2584ec94ffceafc4ffcd3a6b5563fa1d632844e

Analysis

max time kernel
38s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Size

78KB
MD5

0163a114f3cd11d4a2d3c1374bf4878d
SHA1

96b9b8510641a18f7920f48078087001a16db568
SHA256

568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919
SHA512

0104fedf9a6cc994a267f743c8fa3324af388e2191dec5aff1eedf7345a1d0bbb4829db2b846dd6f7e63e2e4c04aaa0d315ed8b7361c8fbbd8b9f0096e90cba0
SSDEEP

1536:freiQwer+Gu3gzQ6qOAI2PneemZcsABvYPpXUJqnwBWH9R1X3Jq5:yiPGu34Q6pAgeJsOOYByXHJ

Score

9^/10

persistence ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (482) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 2 IoCs

Processes:

568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VmHslOfI.lnk	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VmHslOfI.lnk	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe

Loads dropped DLL 1 IoCs

Processes:

568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe

pid process

1520 568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\VmHslOfI = "C:\\Users\\Admin\\AppData\\Local\\Mozilla\\nEBOLQBm.exe"	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe

Drops file in Program Files directory 64 IoCs

Processes:

568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\grid_(cm).wmf	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipssve.xml	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\ApproveWatch.eps	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Services\verisign.bmp	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Seyes.emf	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Sand_Paper.jpg	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwresplm.dat	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsita.xml	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.htm	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Connectivity.gif	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Music.emf	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-join.avi	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwritalm.dat	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\VSTO\vstoee100.tlb	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-correct.avi	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.htm	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\GreenBubbles.jpg	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2828 vssadmin.exe

pid	process
2828	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe

pid	process
1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exevssvc.exe

description	pid	process
Token: SeRestorePrivilege	1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Token: SeBackupPrivilege	1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Token: SeSecurityPrivilege	1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Token: SeDebugPrivilege	1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
Token: SeBackupPrivilege	2824	vssvc.exe
Token: SeRestorePrivilege	2824	vssvc.exe
Token: SeAuditPrivilege	2824	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe

description	pid	process	target process
PID 1520 wrote to memory of 2828	1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe	vssadmin.exe
PID 1520 wrote to memory of 2828	1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe	vssadmin.exe
PID 1520 wrote to memory of 2828	1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe	vssadmin.exe
PID 1520 wrote to memory of 2828	1520	568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe	vssadmin.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe
"C:\Users\Admin\AppData\Local\Temp\568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\vssadmin.exe
"C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
2⤵
- Interacts with shadow copies
PID:2828

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_ON.GIF
Filesize
2KB

MD5
07517915a459923a5a1096d77d9b35bc

SHA1
9c431640331275d90f8591851c7167159df79a36

SHA256
66dd04df2b29645bfb9c491ce29daf7834a84dcd31f2b19049b07f632d28f7ba

SHA512
762b7739e4db4edcb8a7ff963b7f0835ce575eea6d0fd3c97676c7c701a01cdd14cab7cfc1abe703e9ef305cd1a951565918076c0d4373766109c66685ed1248

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF
Filesize
2KB

MD5
8e5c26eacb28d75b31d79d926cba19c7

SHA1
b7d93d5f6ad3f417c2ff5127fac880d88958f770

SHA256
5d01fb1510aad5ba5b2dfebdee406cb72c378d8c7d072307f755c9a0dcd2f594

SHA512
a29349ad2cc72dc41561b48e8f5c637f5ff59fbb2566ce79dbca595f07aca8dedb15456c8141b8ad5a41cacafbf85ce28b3172bdc56b5fe5dde35ae0c561351e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\TAB_ON.GIF
Filesize
2KB

MD5
e4ef5753cd3589d9332c14e73b273a88

SHA1
007f7d1fcd2d18dfc1f9e9e0bb52aa6ecbac8dec

SHA256
b7b105221fb425518e28b27907c81af3cd56d9b262edc700975e9d8a5a9b3d2e

SHA512
80682ede69c73e5051b5543a9fc17b9cbe4a2aaeeda53157a5f16e7959209eefdd8615eabbae34de7040f22b77470cb2baf658afcd437bba93e5293462ebc7e8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OLKIRMV.XML
Filesize
79KB

MD5
991936d293e4e8a4dd98041cf15e7dbf

SHA1
bb669422c7f50de5f179a72d21150e148e82a051

SHA256
6edc93fd3692b0857eef9b74babcb5a3de842bce064d4abdba2e4fab1398d3a6

SHA512
1fe020dee023dc899e8fccb912b23889db380b6321c44f13dea71e62c77c1bb5e3dbbd3eeaee9d5c09f3c2bfc68be3f43b6fda8e2f8c41cc424051c917ecc7fd

Download Submit
C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\vcRuntimeAdditional_amd64\vc_runtimeAdditional_x64.msi
Filesize
92KB

MD5
c31d82610451bc55f1c31e124e36e4ba

SHA1
2acf1cc40af32056b657da81e4173450fa1b43f8

SHA256
c39aa3fc820d316739c8997f4b1261c17edfd64dcec62532f0f4eec9953dc392

SHA512
4fbf4a41c26f5dbe0546675057e2d5bfc6763720829e44f1eb2cda0cde2325f81520a6602918f17025b503ebdc855e6fa4e3bb514e98021c833561dce5bdac13

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\9.0\Cache\AcroFnt09.lst!==SOLUTION OF THE PROBLEM==blacknord@tutanota.com==.Black_OFFserve
Filesize
9KB

MD5
09403f4076416e7be4aa3a0068350085

SHA1
a2dcc7de9d6f9c80cf37d5e1e69ee71399e088de

SHA256
249fea9414019d6cf08f5a780e450f8243768a0dc46ff384b76e4360bfc6c3ca

SHA512
48f703fdef4da7cfafe9b52e069bb3a75db822d5799db7e3e8f55eeae49fac3b4b7539d32714aec9c0ca8859b2fbefe442d9f1e74016e8095c98d08b01fb5867

Download Submit
C:\Users\Admin\AppData\Local\IconCache.db!==SOLUTION OF THE PROBLEM==blacknord@tutanota.com==.Black_OFFserve
Filesize
92KB

MD5
ccd30a6c189878a66220b78775b7942a

SHA1
d5ee0d7d73817c3469ec3d99a225b64c77002e7d

SHA256
d8c69af134b1d65179f8cc4e7e5ac29cf2722a62513b269e116e947725fa66e6

SHA512
7c347177a7b17668257f61717f659c50a98e8e4a884f851951f69dc0c22a488f395a7f6f6ef03055e8d1350d4a73550427fec5e628da9253157b96a88cc5e3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\MSNBC News~.feed-ms
Filesize
29KB

MD5
279c057c301d4e5b5ecc638a3c58c932

SHA1
ee4dfeb225375f2747cd01e26bdb78369f59d6d1

SHA256
52a930e794f72198dd0011889ce9da276b02bacca432e70a225f06ca204461ae

SHA512
791ee8ce2e9d03becc4c2e826706ee909a5f8295b75dd514df84dd9c8347b34cd70af3070652aed2e3fcf8777506a10cb25aa3406b18c2d836d1049f467b69c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Work~.feed-ms
Filesize
29KB

MD5
9cb794e8485735b0155443d6fe8b0d8e

SHA1
63d8b6e86ad1347c23935fe96a5933458e8c31fd

SHA256
ee031a7fd02b2f1ab7154a9f2676b42307f0dab19f47a8c49800a44cf5f2b421

SHA512
f156b277e7bc24891eacfc8486cd9a0412244818fd425600aa411ebbfd7aa44576496bbe5fb9d77d2ddbe6fe9d8a0eebba9c32dc9a678bdcb51bfa9e91de078a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VmHslOfI.lnk
Filesize
1KB

MD5
b657c23074a14a75893a996660e9414d

SHA1
4f3cb3bdcccc61c7fc37453fe8f5c64ffe449c24

SHA256
3878e536d1f6b8ae34fb32e93319eb71a0727b83224e4d70c709dbd2e0805e6b

SHA512
9ec122dd78a27989cdfef78858db6a4d7a2331cec659807e29c6c72facce38c8610d15999f8e4284270f64d878c41cfa5eaf173a78a4ef7809034b0b6dda58e1

Download Submit
C:\Users\Admin\Desktop\AddRepair.html!==SOLUTION OF THE PROBLEM==blacknord@tutanota.com==.Black_OFFserve
Filesize
263KB

MD5
98ceaa025e11f2a651130805f3d541cf

SHA1
053a1ecbee6328480db9953a887110f12953e31a

SHA256
9b3a76cc05c79a6a0be359ec4a05fc5f4a0b4a9a68846368cbcd4a8f1d05f504

SHA512
db4996f213d57f0bf392566ec7907548e125d258e1e009399b79af299d533fbef6c3e544b99a5e9119b1fdf8b90023a9722f8ff4600874bf93767ae58c07e941

Download Submit
C:\Users\Admin\Desktop\BackupCheckpoint.3gpp!==SOLUTION OF THE PROBLEM==blacknord@tutanota.com==.Black_OFFserve
Filesize
275KB

MD5
ec4b37175c1d0dba183112d6b555850b

SHA1
4fbf9a5f20f9c6ba3635844e6228f5a60c225064

SHA256
5609573b45d7c9a24e2ac73d84bd25efefae24c8090920813ed171365cf05f1f

SHA512
edad97a554753ba46b9318e6beeadcdf68ea126998d816833e107933e3a661ccea94077191b6fe4f807c02c2e5120f2f7848668a12c36e6db246a01d4f5342af

Download Submit
C:\Users\Admin\Desktop\CompareClear.wmf!==SOLUTION OF THE PROBLEM==blacknord@tutanota.com==.Black_OFFserve
Filesize
337KB

MD5
941d427896461fa36353261075ca38d3

SHA1
038618652b3563eb4e85cc6e74179c53f797d22e

SHA256
38a9d2ee88b66ecb78cd453f46a33cd4960577419b64c97858b49a664b51f264

SHA512
b46ad1bee3d1c99f4c3675db1f1e5a2b247200d852583b6feb28a5e9c4b1c627de96a5ab2fd93cfa9ad2a26e659f8e429cd99172e36405128402bf1154d2004f

Download Submit
C:\Users\Admin\Desktop\ConvertToInstall.xltm!==SOLUTION OF THE PROBLEM==blacknord@tutanota.com==.Black_OFFserve
Filesize
425KB

MD5
b5e9b0eebc32d00ee6793e3d5eef6694

SHA1
169ec08b17f1e637cfe950a257f9992962de7293

SHA256
dce8c8dafab03448aa9c265b2610213c1ee6bddb59bd89806fd53878450812b6

SHA512
4d66675509394e65a814173fd0631eaf089b2222e3d9de732d9b8365eef5f410de80a19979dbc1f8962413150820147aa5d333719dcd0004ec28fbcf8314343a

Download Submit
C:\Users\Admin\Desktop\DenyExport.ADT!==SOLUTION OF THE PROBLEM==blacknord@tutanota.com==.Black_OFFserve
Filesize
93KB

MD5
be0729fa9fd689668a31581445031d09

SHA1
5cf955d9ad945bc3ad7f91e6db4d80692fb109ed

SHA256
f96f9c155c165f15ea900a907cc76271afbfd30862173178ea1faf5c4070f3d3

SHA512
e146ee9cc04515ce0fcb80eb7746b93ba0aaedb35ed098db9e24f0b00ade620b2f1759c36cba3f51374373626ee27482f312a3569c5b963fafdba6d2be619456

Download Submit
C:\Users\Admin\Desktop\ExpandReceive.dot!==SOLUTION OF THE PROBLEM==blacknord@tutanota.com==.Black_OFFserve
Filesize
93KB

MD5
92811745064a35901e2047cf1c494f13

SHA1
77a87c74b03e743b63aff86106e8430e5a120ed0

SHA256
6eeeb3eec49dd1ef09e23bc52d7d57c9dbe8981138030f6ff7e7d43269bb5441

SHA512
00ea0ad8c063a5a9b4864a4aa62f91dacf3a0cb1f718995dc59a494120ade7b8cd846ed6dbd0339b4defe4943d88e3bd50437acb311584a20edee3ee1dcb01c8

Download Submit
C:\Users\Admin\Desktop\ImportSuspend.pps!==SOLUTION OF THE PROBLEM==blacknord@tutanota.com==.Black_OFFserve
Filesize
325KB

MD5
c7846d2373ed8a374790cfdd6d228149

SHA1
d63ba7fe77ddd3710001df2d93a0a126e1d03eac

SHA256
b431910272b4764ff7ecdd0e78af6dc487c0391e08633b6997eb5a7a7157d2c2

SHA512
af3462ad8ffcea3026462f6d806c2372bd5577c8041baaa1299c8731834c0eebf7efbdbb9d22fc74a43aee0b04166dfbf342112e425c0f77315e91d4133c6427

Download Submit
C:\Users\Admin\Desktop\ProtectImport.DVR-MS!==SOLUTION OF THE PROBLEM==blacknord@tutanota.com==.Black_OFFserve
Filesize
176KB

MD5
b1ea445faf5ffcfac67beeb940613335

SHA1
d8eafbeeab15c055837b9bff80f222a04c8ffd14

SHA256
f7fd5541387adac36b87b095ee26e52ef53f036453540c8ede742ca4538406d5

SHA512
65327a15925c8f3d8aadd495368ab93a5af8fdaa19fe240263ee440dcd83ad73655498b28334e2619666856f4813464748e2ccf3806b6d995d0f0164ee384d55

Download Submit
C:\Users\Admin\Desktop\PublishReset.M2T!==SOLUTION OF THE PROBLEM==blacknord@tutanota.com==.Black_OFFserve
Filesize
350KB

MD5
c6696d2e8d767e606f7e40ed783c4fc6

SHA1
13b785b7e7e34e6e9d6357e041cb14709f7ba7be

SHA256
728330fa2f9321a3d881a1635825b4a7ea18eb30bd8d557147251e71348b87ed

SHA512
4fcf2a1cc44a3e696998e218fd836e62b41cb3837428f2f4cc08cb6f75b92013c97ffd948b7c48d28e5cdccb49235e4f63ea4072e54221ba2a31d4424ced62ac

Download Submit
C:\Users\Admin\Desktop\ResetExit.m1v!==SOLUTION OF THE PROBLEM==blacknord@tutanota.com==.Black_OFFserve
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Mozilla\nEBOLQBm.exe
Filesize
78KB

MD5
0163a114f3cd11d4a2d3c1374bf4878d

SHA1
96b9b8510641a18f7920f48078087001a16db568

SHA256
568a79ce585dac32af237cb187b663cb6d2e4f594d66860c7ea1b3c66e4b7919

SHA512
0104fedf9a6cc994a267f743c8fa3324af388e2191dec5aff1eedf7345a1d0bbb4829db2b846dd6f7e63e2e4c04aaa0d315ed8b7361c8fbbd8b9f0096e90cba0

Download Submit
memory/1520-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1520-2-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads