Analysis
- max time kernel
146s - max time network
139s - platform
windows7_x64 - resource
win7-20231215-en - resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system - submitted
02/01/2024, 23:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe
Resource
win7-20231215-en
windows7-x64
26 signatures
150 seconds
Behavioral task
behavioral2
Sample
6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
General
- Target 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe
- Size 2.5MB
- Sample240102-231rgsecg4
- SHA256 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0
- MD5 14e777412523173eb4dc71e384bf6f57
- SHA1 69cb197a2336a58924f8f71bb65ac43e6668533a
- SHA512 7251eda0171dd058435786066e31a2a054c1319e4f7e701441a4483e3edff5be4a27e5408ba413bb6e6d7919310f9f030e9d5106feccb2763e1ecb22baf02794
- SSDEEP 49152:EPTt5uBMb2Rw/y0bgJjFmriZ7IT2dPWR8lFPYwPmfn3HQIyOcf:+pBb160bgJjwrF6gqp7yXQIyO4
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" 5ik2kS2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" 5ik2kS2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" 5ik2kS2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" 5ik2kS2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1" 5ik2kS2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection 5ik2kS2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" 5ik2kS2.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\FANBooster131.lnk 5ik2kS2.exe - Executes dropped EXE 4 IoCs
pid Process 1408 rb7ZA41.exe 2696 te3ZF22.exe 2992 2xr5439.exe 2536 5ik2kS2.exe - Loads dropped DLL 15 IoCs
pid Process 1996 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe 1408 rb7ZA41.exe 1408 rb7ZA41.exe 2696 te3ZF22.exe 2696 te3ZF22.exe 2992 2xr5439.exe 2696 te3ZF22.exe 2536 5ik2kS2.exe 2536 5ik2kS2.exe 2536 5ik2kS2.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe 2196 WerFault.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features 5ik2kS2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" 5ik2kS2.exe - Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5ik2kS2.exe Key opened \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5ik2kS2.exe Key opened \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5ik2kS2.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" rb7ZA41.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" te3ZF22.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\MaxLoonaFest131 = "C:\\Users\\Admin\\AppData\\Local\\MaxLoonaFest131\\MaxLoonaFest131.exe" 5ik2kS2.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 121 ipinfo.io 120 ipinfo.io - AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0009000000016cdc-24.dat autoit_exe behavioral1/files/0x0009000000016cdc-27.dat autoit_exe behavioral1/files/0x0009000000016cdc-29.dat autoit_exe behavioral1/files/0x0009000000016cdc-28.dat autoit_exe - Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
pid Process 2536 5ik2kS2.exe 2536 5ik2kS2.exe 2536 5ik2kS2.exe 2536 5ik2kS2.exe 2536 5ik2kS2.exe 2536 5ik2kS2.exe 2536 5ik2kS2.exe 2536 5ik2kS2.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 2196 2536 WerFault.exe 36 - Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1304 schtasks.exe 2968 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410398773" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CFAFA641-A9C3-11EE-B6E5-76D8C56D161B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CFB6CA61-A9C3-11EE-B6E5-76D8C56D161B} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000460666f2c9c3622ffd91b27866f25d661ff0fe63b9df05ec5d86b1c63cc416df000000000e8000000002000020000000b0ab9979e83716f83a2853e7feb1f736c333eeb6ef6b239d43b70d174117fb4f900000000a28d6ced8cdfa80bba9fba06a8b42df37545ac3416c367070b5c01f0a157b5262727922f33a9e226b223251100e78565ac86ca23052e7d1f56c3cb9b6727fa499da92e9bd0361baa35389397b3e2f95432651ab8f70bda8bcd95567095c4eaabb62292599961891a394436a7bd777fa68ad4439c0ed6457b93e3764afd9d3634bb8bcb1c100af70927083ab504323b340000000e815ddde69dc9fa0be0c4c924371757b8fc838df063b805d2bff73b38d8022b43ef52668ca8704f936075342788c0335bddcf3bb245c7fb9cd36252069ae58d6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CFB207A1-A9C3-11EE-B6E5-76D8C56D161B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 5ik2kS2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 5ik2kS2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 5ik2kS2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 5ik2kS2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 5ik2kS2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 5ik2kS2.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2788 powershell.exe 2536 5ik2kS2.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2536 5ik2kS2.exe Token: SeDebugPrivilege 2788 powershell.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 2992 2xr5439.exe 2992 2xr5439.exe 2992 2xr5439.exe 2324 iexplore.exe 2136 iexplore.exe 2688 iexplore.exe - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 2992 2xr5439.exe 2992 2xr5439.exe 2992 2xr5439.exe - Suspicious use of SetWindowsHookEx 15 IoCs
pid Process 2136 iexplore.exe 2136 iexplore.exe 2324 iexplore.exe 2324 iexplore.exe 2688 iexplore.exe 2688 iexplore.exe 2536 5ik2kS2.exe 2280 IEXPLORE.EXE 2280 IEXPLORE.EXE 548 IEXPLORE.EXE 548 IEXPLORE.EXE 2532 IEXPLORE.EXE 2532 IEXPLORE.EXE 548 IEXPLORE.EXE 548 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1996 wrote to memory of 1408 1996 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe 28 PID 1996 wrote to memory of 1408 1996 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe 28 PID 1996 wrote to memory of 1408 1996 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe 28 PID 1996 wrote to memory of 1408 1996 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe 28 PID 1996 wrote to memory of 1408 1996 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe 28 PID 1996 wrote to memory of 1408 1996 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe 28 PID 1996 wrote to memory of 1408 1996 6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe 28 PID 1408 wrote to memory of 2696 1408 rb7ZA41.exe 29 PID 1408 wrote to memory of 2696 1408 rb7ZA41.exe 29 PID 1408 wrote to memory of 2696 1408 rb7ZA41.exe 29 PID 1408 wrote to memory of 2696 1408 rb7ZA41.exe 29 PID 1408 wrote to memory of 2696 1408 rb7ZA41.exe 29 PID 1408 wrote to memory of 2696 1408 rb7ZA41.exe 29 PID 1408 wrote to memory of 2696 1408 rb7ZA41.exe 29 PID 2696 wrote to memory of 2992 2696 te3ZF22.exe 30 PID 2696 wrote to memory of 2992 2696 te3ZF22.exe 30 PID 2696 wrote to memory of 2992 2696 te3ZF22.exe 30 PID 2696 wrote to memory of 2992 2696 te3ZF22.exe 30 PID 2696 wrote to memory of 2992 2696 te3ZF22.exe 30 PID 2696 wrote to memory of 2992 2696 te3ZF22.exe 30 PID 2696 wrote to memory of 2992 2696 te3ZF22.exe 30 PID 2992 wrote to memory of 2688 2992 2xr5439.exe 31 PID 2992 wrote to memory of 2688 2992 2xr5439.exe 31 PID 2992 wrote to memory of 2688 2992 2xr5439.exe 31 PID 2992 wrote to memory of 2688 2992 2xr5439.exe 31 PID 2992 wrote to memory of 2688 2992 2xr5439.exe 31 PID 2992 wrote to memory of 2688 2992 2xr5439.exe 31 PID 2992 wrote to memory of 2688 2992 2xr5439.exe 31 PID 2992 wrote to memory of 2324 2992 2xr5439.exe 32 PID 2992 wrote to memory of 2324 2992 2xr5439.exe 32 PID 2992 wrote to memory of 2324 2992 2xr5439.exe 32 PID 2992 wrote to memory of 2324 2992 2xr5439.exe 32 PID 2992 wrote to memory of 2324 2992 2xr5439.exe 32 PID 2992 wrote to memory of 2324 2992 2xr5439.exe 32 PID 2992 wrote to memory of 2324 2992 2xr5439.exe 32 PID 2992 wrote to memory of 2136 2992 2xr5439.exe 33 PID 2992 wrote to memory of 2136 2992 2xr5439.exe 33 PID 2992 wrote to memory of 2136 2992 2xr5439.exe 33 PID 2992 wrote to memory of 2136 2992 2xr5439.exe 33 PID 2992 wrote to memory of 2136 2992 2xr5439.exe 33 PID 2992 wrote to memory of 2136 2992 2xr5439.exe 33 PID 2992 wrote to memory of 2136 2992 2xr5439.exe 33 PID 2136 wrote to memory of 548 2136 iexplore.exe 37 PID 2136 wrote to memory of 548 2136 iexplore.exe 37 PID 2136 wrote to memory of 548 2136 iexplore.exe 37 PID 2136 wrote to memory of 548 2136 iexplore.exe 37 PID 2136 wrote to memory of 548 2136 iexplore.exe 37 PID 2136 wrote to memory of 548 2136 iexplore.exe 37 PID 2136 wrote to memory of 548 2136 iexplore.exe 37 PID 2324 wrote to memory of 2280 2324 iexplore.exe 35 PID 2324 wrote to memory of 2280 2324 iexplore.exe 35 PID 2324 wrote to memory of 2280 2324 iexplore.exe 35 PID 2324 wrote to memory of 2280 2324 iexplore.exe 35 PID 2324 wrote to memory of 2280 2324 iexplore.exe 35 PID 2324 wrote to memory of 2280 2324 iexplore.exe 35 PID 2324 wrote to memory of 2280 2324 iexplore.exe 35 PID 2688 wrote to memory of 2532 2688 iexplore.exe 34 PID 2688 wrote to memory of 2532 2688 iexplore.exe 34 PID 2688 wrote to memory of 2532 2688 iexplore.exe 34 PID 2688 wrote to memory of 2532 2688 iexplore.exe 34 PID 2688 wrote to memory of 2532 2688 iexplore.exe 34 PID 2688 wrote to memory of 2532 2688 iexplore.exe 34 PID 2688 wrote to memory of 2532 2688 iexplore.exe 34 PID 2696 wrote to memory of 2536 2696 te3ZF22.exe 36 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5ik2kS2.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 5ik2kS2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe"C:\Users\Admin\AppData\Local\Temp\6b05772e39ea7ae4c3396fbedc1e5a462db3cd611be8548f452b2ec19f1581c0.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rb7ZA41.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rb7ZA41.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\te3ZF22.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\te3ZF22.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2xr5439.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2xr5439.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://accounts.google.com/5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:26⤵
- Suspicious use of SetWindowsHookEx
PID:2532
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://facebook.com/login5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2280
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.youtube.com/5⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2136 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:548
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5ik2kS2.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5ik2kS2.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2536 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST5⤵PID:1952
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:1304
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST5⤵PID:1816
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST6⤵
- Creates scheduled task(s)
PID:2968
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 24685⤵
- Loads dropped DLL
- Program crash
PID:2196
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
- Size 1KB
- SHA256 db3526092a2b02b7cb7775efc9c32b74c67a805f4178b237959f08f96b365971
- MD5 5d89cda4d8fdaf7ef3aa43ce6983b6ac
- SHA1 4559efc49b1cea11bc215ddeca559c1b72c470eb
- SHA512 678c927df6758d6f43ecf558ffa59d3c6a80ac390bcbb5222e28bcd07166fe4e174c439b0b1a4b36f0edfd5458123f46b1269c998a0198ac8010b3d5f1571d93
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BEC6224B02D155A396218A2504F3EE0B
- Size 7KB
- SHA256 8e69986717198188eabd71f661dbf0e4accfa70f08fe3ac713caeb197576ad57
- MD5 e4feae556147305e313beeeb7a2ef843
- SHA1 7d92a5f2bdfd1fb5d2c7aa94edca22c098af2c7c
- SHA512 e2270e4aec0aac8b192479cff9cc3bdccb01f576a1770032c4dd3f8df466e2c957c79a8fc22baf84cb5014b05ea4fc5d0ce9a77530ac7f7cf91426fd7ba3dabf
- SSDEEP 192:G+9AT5EmWdNMWQfbVydpJIX0kNsEnnbKjNVWu3Sp0QedB:GcltvpMXnncWTeP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C88418EDBE65AF3960916D9E8011370D
- Size 15KB
- SHA256 75328514326bcb0f1fcd1ff28eef8b26e52c5128ab9a58b3bcad683a762cd9e2
- MD5 e5d6904334bd9afa26c8d757af4fa3bd
- SHA1 c195992a8d262ade796c149ccdb622f48c95af26
- SHA512 a58447e6436e1f746df0b36dc6c293096ee0a9749dc9ff5685a84257b162422446b7895f5724a843d226ede691fb3fe511901577aed6e2db0583a996a9a6c0b5
- SSDEEP 384:2/MNzhGLk4nmqcahlyKJscAjI9fU2ZmcseDtvMcsVPBAtH9PfKYfo4gBA8VzMwmb:2/MNzhGLk43AxI9fJQcseDZMcsVPBAt9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
- Size 724B
- SHA256 0b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
- MD5 ac89a852c2aaa3d389b2d2dd312ad367
- SHA1 8f421dd6493c61dbda6b839e2debb7b50a20c930
- SHA512 c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
- Size 410B
- SHA256 9ad0aadf3f24e9f9aebfb8c077e2362835b1350bc004867af464125ec74c50e3
- MD5 b4884d4eb1166b588b3516bdc6eb0620
- SHA1 c339831b0024a037dd4eab2dab593000f6c83a40
- SHA512 1aadfd027fdc305e4b26d86311ffef8de2034aff9b2f3216d381590f5cea035e905a5bcd691df96f005f04150c1443000c481ce0f300a1cc9a566eb1e874a9bb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 eb1fa51d65f1cde0bd1aba544395dcfe8d6e9c476e01b55bed31cf92ff031ee3
- MD5 3c34b91c933b39fa7c2d0a2235c9afb0
- SHA1 d12b1f24e8731de91d6915479a70f14928e85293
- SHA512 4c16bdea49a8dca8294988dcbf435bc5190262ddce0c03f0c9f54b49155dddeed425eb9d36dad078f1755961a5587c1adfe84de22c6e2ed8971f11c9838949a1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 60db599419c1304781d1534845fbcc54221ded39e0059793da659f2bdb808f3c
- MD5 02b762422ff744efd46bf3a0cad3eb72
- SHA1 3877d1c077cd28741b3952ff8eb9f5ecb2ecd0dc
- SHA512 424d9ff3b12404853cb752e86df719effe208c511a35676e4f05ee96031bcac2e187aea48b1bfa8762971b65202ffde1782c4ffa362b82ffc4cc53deaec5b7c8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 ce100f3858c6b5eba2e3dc3c3e7f1bf618655ad51ce17310d86dc11e0e329f20
- MD5 f7c168323704e666d695238d700feb1a
- SHA1 f446e6edd37bf1099795a11f0078835c77029fc1
- SHA512 5598af1699c60821e2091137116c2ac7abf7ab2a8ce15d23c6c563208c859d513da34a396bd2097af38512c3b315a26280a77b9191f280cb1c89bd2a6647fae7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 d31ad282d6b402b908b533b8e9fc62cef4e8df7c4e45e91b0a0d920d1ad54e91
- MD5 ba3dd4c05ed5f1b12ab417a184859ed4
- SHA1 f9f6492cdf232c0c4f42d6e57d4d09e743ce0b03
- SHA512 1f712206e627e9baa4a8b149fcb980742163cadf35491c9c1fd89bb661a749bbbd9a474b711c5d25cbd16bb1a5c826b2661376b9e332e3aebe05c78e012d5915
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 8e23cc05631ada5597f634a564897cf6d5a68253772743000c5469c9e70bf315
- MD5 093bf76f6e3571785593deae9e58a7d9
- SHA1 972214c82ca3cd760836f0419868b41590604662
- SHA512 453aa545c4baac42aa14b28a72e752bb902806c74ca858f4f7896bb4dc9c2c3623e666c13597330e305b985df5d6b8b42d91df3c051994af5b7395f4fcbf9789
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 77f4aa083fe7d193eed0c70a07622b7cb3941f2f573ae3c6b67e4cc7f25fe721
- MD5 72a328c7d2c7febfb9008dc1214838ca
- SHA1 b95508625a17f7dc2ed314054c57b947f06f44e5
- SHA512 96545b4fcbeb37144e6c2d52599f996f6e4552695834a00f933d9f9cac96269ee4e239f9ede0f853fd448ed81091220719890775fe9a17bc40905a0a0e8bddf3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 616f213249e98abf98b548e2a2a14b416a60be02deba3b568a2bd1871054d7ce
- MD5 fd8ad983eda1e17e0e2247f278ecb302
- SHA1 5eea8d1027e40e84f7b1a2d056a30d3fd7e94233
- SHA512 7879d4cdd481bf24b2ce94a1975f97fb337f45e50c8e44d605297d0d90029d339ce3b064265c89ef1ea0038d608d52e306f93d6c4adca0ead47ce3baca3b3a8c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 e51c267a40652974e9c7149b9f70714000f633518cdb4b03d890d71a0faf2f4e
- MD5 80ce46a40f0660156b3181a1a03e87d6
- SHA1 612bc5d24b1670dfd5e6b9136a65e05ed8fc5e3b
- SHA512 bddc152326a68f04a162cfc30dc0cf65e56388f229ac03a54e7fe3c7f19550ea95f0b33ec58c7bc4215ebe342dee3e302fd695300aafb64ab45f1f0c07133668
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 c0b59bd001ff05a4f339e83049f92f94b53ab684eb168a14d67de366f46cc08b
- MD5 eea7bb8e8982e5bcc6e9780523a35fdb
- SHA1 c06907e9d5ac53230f4670a1609f119db8c8850c
- SHA512 d5376ec2fe5ccd3178d2a0886eef57f6b7d2df0108979982a5089070ac9b68d49aefd4bdccbfad1c76ecbd746060e1778692436c620c0db795a8c04d356c580a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C88418EDBE65AF3960916D9E8011370D
- Size 204B
- SHA256 f2d81cdbbad43d185156f177844ebb84c78cde3ee20150177c7b07aa4bd3cd50
- MD5 bc3bbcf98131402842fc198035d7aca3
- SHA1 0975126c39af83529d476476422c13b7124c3b4d
- SHA512 2fceed3a5539025a673ce3cc68c78ac04a414edb6fcf81bf15dff7dfaaab689d11c8a2614fe1389028d227c49c78a1ca5cefd33263314708b5f052ffcae6c732
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
- Size 392B
- SHA256 363d47c13192380a19616e366a699870dfb7965a67091e5213f7da8a9871f9b4
- MD5 e003567ba8d193ee52057e4ac7f27fd2
- SHA1 3e97e023c0d448ad05865623cbfd3fbd84d2632d
- SHA512 56cbaa0794d195a9180f2278161ce33872ee0b6baf6b8479257160027668a3496a19105f39c15c20ed6317162a5cf3c3203e6e45f14603de163065fe20d78e9f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\MaxLoonaFest131\MaxLoonaFest131.exe
- Size 796KB
- SHA256 2f8ad50d7b232a1099999e7c1743aeee591888022296d9f5f8ab3658818f834d
- MD5 b5a981d79a62f7db2555212649966cb0
- SHA1 1e0fa5fac2465e6ca1d87a92c1ed8d506692eed8
- SHA512 b66b6f32cdbd96588db057f601540cf82d6cba93655f0b9010632da20cb449569119df571439ce51c8fc2856c1ed69b6069d8603e4425658dbd33d22a1e262ac
- SSDEEP 12288:ACvx20lHfYFVR8xKpICxfwxeq8nIyyL9C6RAGtbWO/YeFDevszO/2A7:Ac20ZgFVRNpI8INxPANOQeFg/N
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CFAFA641-A9C3-11EE-B6E5-76D8C56D161B}.dat
- Size 5KB
- SHA256 9af209335499fa7676b7e6609cb6b44e8d30655e007a52592f5d942d6420f255
- MD5 4d04ad8925f034dfe0fa2dcc39fb875a
- SHA1 d6f70e31917742e1fcd2eaedf82bf577e21974db
- SHA512 7a2561926154b8acd3628c47979d9dce6e4fd0dd5056149acb7268e8738c37fa8613436fbe61bf3f059eef859858d4e84e9c2e1d414c633946fac3bd0697568e
- SSDEEP 12:rl0oXGFvrEgmw+IaCr8Oh+yD/GbCForEgmw+IaCy+yDBu/yDusG77dQNlTqYE2Tj:rQGo/QxOEGo/tOQO8QNlWY8dDNlWY8d
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{CFB207A1-A9C3-11EE-B6E5-76D8C56D161B}.dat
- Size 5KB
- SHA256 a2f93763c23fb34d9ab2193c8842f95d371e9dcd85a209fc40b2160ff2753bc8
- MD5 1f20cfcc6bde9dbeb849baf643a81a4e
- SHA1 8833bd007833bd4e50277e101b146cc0255d0d25
- SHA512 3c15aabb603395aeeb1f700b427679c4288b4e816fb3caeb5ab530a7b8374a2cc634af0f0de848c503c3c8ade6da204fbae4f84304478763a847df06e643b1d1
- SSDEEP 12:rl0oXGFvrEgmw+IaCr8OheD/GbCForEgmw+IaCyeDBuHDusG77dQNlTqZRq/Oyqs:rQGo/QNEGo/Rk8QNlWeWExNlWeWE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f9yyw0t\imagestore.dat
- Size 1KB
- SHA256 e1a04f4f87aaac4fd53301c8bddc1ad2d43447d7ef39a71875a33ace3b30adc9
- MD5 b541c0c79fe936f0f3ced852fa9f849d
- SHA1 08ad563a88909625f2fb5044846a4a83c45be176
- SHA512 592b3e2214ba9da7e85f961b5f421a725f01f3f6b9a59c6498c74f5f34a0e19b56d66da80a0f4768ded772b08e8f6289ed5646d24f566b67b6617612e622d3a0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f9yyw0t\imagestore.dat
- Size 6KB
- SHA256 17675548ade4f39d57b80cf7d3c70482f2aaf31a9d9db923ba29a1c4bb8ca5c0
- MD5 2ec344dacf397b0ac7bb6b9e43e987b4
- SHA1 6bd988845f9430e1aa9d9f74cbba12ab02f7503d
- SHA512 b3d306c4a44764558ac60eec5031a26fd5d518bc229275de046b0cf7ca76e6df8f9388342265293936572ddd39fe5978c58fc982fcb679da143dbf1d68c2f30d
- SSDEEP 48:4bOmRBk+DaO7IJct3xI8k+DaYxG/7nvWDtZcdYLtX7B6QXL3aqG8v:SRXvIJct+oP47v+rcqlBPG9S
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\f9yyw0t\imagestore.dat
- Size 11KB
- SHA256 1d99a39ef09c4b3e1e4cbce1b76a1425fa8c8e64965db26fbdad24bd5850ed55
- MD5 977414ff91e2c3af3d5e03796ee21889
- SHA1 a45eecb9714f4b35449a4b6eeae044b09d54da6c
- SHA512 6e532db62641d735543d316e005a1212b81e1cb454f15a696c7fa35c2eb5d793de2cbb6f7a644b9a57ca3a4e7eab749a945a00294c85bf5c298f4ad7597f7aad
- SSDEEP 96:SRXvIJct+oP47v+rcqlBPG9JP+8ItBBBuxc+6QQQQQiRRRRRRRRRRJJO9P111115:SpvI6tpPqWceBPGfcjRRRRRRRRRRi9H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E1CCB52I\favicon[1].ico
- Size 1KB
- SHA256 8bb1d0fa43a17436d59dd546f6f74c76dc44735def7522c22d8031166db8911d
- MD5 f2a495d85735b9a0ac65deb19c129985
- SHA1 f2e22853e5da3e1017d5e1e319eeefe4f622e8c8
- SHA512 6ca6a89de3fa98ca1efcf0b19b8a80420e023f38ed00f4496dc0f821cea23d24fb0992cee58c6d089f093fdefca42b60bb3a0a0b16c97b9862d75b269ae8463b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E1CCB52I\hLRJ1GG_y0J[1].ico
- Size 4KB
- SHA256 89676a3fb8639d6531c525e5800ff4cc44d06d27ff5607922d27e390eb5b6e62
- MD5 8cddca427dae9b925e73432f8733e05a
- SHA1 1999a6f624a25cfd938eef6492d34fdc4f55dedc
- SHA512 20fbee2886995c253e762f2bb814ad16890b0989deab4d92394363ef0060b96a634d87c380c7ba1b787a8ab312be968fed9329a729b4e0d64235a09e397db740
- SSDEEP 96:5+8ItBBBuxc+6QQQQQiRRRRRRRRRRJJO9P111118B:1cjRRRRRRRRRRi90
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1J1BPYJ\favicon[1].ico
- Size 5KB
- SHA256 6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770
- MD5 f3418a443e7d841097c714d69ec4bcb8
- SHA1 49263695f6b0cdd72f45cf1b775e660fdc36c606
- SHA512 82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563
- SSDEEP 48:wIJct3xIAxG/7nvWDtZcdYLtX7B6QXL3aqG8Q:wIJct+A47v+rcqlBPG9B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Cab4D66.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rb7ZA41.exe
- Size 901KB
- SHA256 e1cea282565a9ba9b16a99cd48c3f95002cef8cd4ecdfce955e348a62009afaf
- MD5 eeb2fa7a1ffde64d0925beaee49e267c
- SHA1 aefa18b0558908121fc441ed516a62663507db4b
- SHA512 8bdb72244562d2ef8eb4729c30f84fffb43693029fb97921bcee9d646713c4bee6972e4817b22a73448199df912f04a509b5352a9edc2691478777e01564fa3c
- SSDEEP 24576:0y8Vq6H0Dqa5o42RwVoy7R/U0Z1FVRCp65:D8VxUuYo42RwVFRMg/CE5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\rb7ZA41.exe
- Size 634KB
- SHA256 27918175d634c5e175c921d2ec29f3ed92be68e398177e655887f227bf56e7c7
- MD5 ad8277f48afad0bcdcaa0555a79ece6e
- SHA1 a25b979da76bb686cd871d0d4b6bfc55e8ac5a23
- SHA512 80b3480b2c646df83c9983411a35d185d2cb431514512c2f2a9863a3a99a7fb2fea239f44889c165072f660f9ec41aea11636f4898c799b44665a8dedb542587
- SSDEEP 12288:vMrby90G8F3lWL6H0Dqa5o23WY2Rw5KsNnafysoRza:0y8Vq6H0Dqa5o42RwVoy7Ra
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\te3ZF22.exe
- Size 420KB
- SHA256 75d514cfe1dbc8c58d15d93a15a53f43e504cef9ded80b384c5855e4db9942dc
- MD5 92ad744f7bed148551630502ca18b410
- SHA1 95470063d9b74c2ad2f82a54a3661e21871a3ff9
- SHA512 e894f6ec75e153682e5ef67c3ecfea0525d2aa7fde9741b2a3bcda4ebf39ecf6959dc92d14db3571eb5b9a20c5790f6f06fff8e2b9d40fafcc12e28199928b22
- SSDEEP 12288:WMryy90o6FzD3L5op86Y2R25KzNna4ysl:Uy36FzD3L5o02R2cNyI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\te3ZF22.exe
- Size 550KB
- SHA256 3e69aa7fbdef8abeeee4ce70c0854e74e0ece79269250037fd15b4e690f2e6f4
- MD5 99cce5bad1ea329a543e934940ed90fe
- SHA1 6bbfd5e23563d28f0745913681684b9fbe6b1916
- SHA512 bc7722059b00237d83514d819f6621acce3447389862c5e331ffc564ccc26a6b453c97706f7e18a6fc56418c2bff634380183c46662d685c2d15dde498d34c91
- SSDEEP 12288:WMryy90o6FzD3L5op86Y2R25KzNna4yszUi1:Uy36FzD3L5o02R2cNyYB1
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2xr5439.exe
- Size 329KB
- SHA256 acf3b7183627695b23dc28387e00b00282abb084aeaa4f525ec6055ec6fa91f9
- MD5 a68b38cde0c54fed2da972b3631e5c3b
- SHA1 3f5a3b0a755f7473f8677f299796eee885dc5dc5
- SHA512 2f2f6437d409253d76c175fb25fd9f219cc1828043a70964d422fcb29568c36750a3b6adbe3e671794689cf312cbe960c54246e5c95724768572413d7ddcb0a3
- SSDEEP 6144:5bV6ZXz5ah5zdgijxgUo+j9cr04DdbzNlUpWu/AvKiK9nnPEe4e7b8O:5qDEvFo+yo4DdbbMWu/jrX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2xr5439.exe
- Size 525KB
- SHA256 b9a6c9bf2eae71b5222e955088a754562309743e2598fae7ca0c17b5f9ad7914
- MD5 d5e79902d7119c1d80362d69d4658711
- SHA1 1ff8743c88bcf7639790742206a65257fba42e0a
- SHA512 5b985f4d612a952658edafdeb10e1c3c853cf5d05d34737cf136fecf4b44b495df16eb620fef1bb32e23a2855780e9946a92a566102482b4982706b2feabbbaa
- SSDEEP 12288:5qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGM:5qDEvCTbMWu7rQYlBQcBiL
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5ik2kS2.exe
- Size 173KB
- SHA256 eef2c37b42b8183c4189beb4a3d6325a92395481b64c2b3df743214903bff4c8
- MD5 a9c598c4fff22325a23f778a73b711ed
- SHA1 7475d8eca255e57e0b0e88f781ae00a5f4f8effb
- SHA512 f794c6d817526f20ac1651d242602037958ec072fa16ba564f683d9489bc1ce0dd6ff010082773e390c62257c7f5e9d9974406fe8bc03b2bb393a22cea1493d1
- SSDEEP 3072:tmrc41YnlP66pi7kyEPKU2ivYTNO9dFD2dVEQZp9Ii0Csw29FoAfYoiqsvJ:tipyC6p/FvYWU79Ii0CsHnfYV/J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\5ik2kS2.exe
- Size 453KB
- SHA256 a596f16a7d751fca1942b43deb7fffdaf505495c4ebf17dc6e91f351b9218dfd
- MD5 573d45db95ab0a511bf30e7a53a6b771
- SHA1 5db724b0f36f6e2304039296e50de8fcd1970d7d
- SHA512 b442ccb1e540de479ad213401e13e1871d0a1fba459b44ea8f7ecfb6944807964cae6098b69d74324a080ca61b3d98c1e724a39b68afe70676bbe018f388927d
- SSDEEP 6144:tipyC6p/FvYWU79Ii0CsHnfYV/gYRoM5cpxKpGuBCwYd3CrVfSHZxO2P9+Urjaqe:ACvx20lHfYFVR8xKpICxfwxeq8nIyt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\Tar4DD7.tmp
- Size 171KB
- SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
- MD5 9c0c641c06238516f27941aa1166d427
- SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
- SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
- SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tempAVSyblMyytL8U0P\Ahd9BnjgRmzfWeb Data
- Size 92KB
- SHA256 13f11c7ad714ef11cf1aa8f720e8b5914c0789025a980dbd2b9c9f10d676d156
- MD5 ec72cf895cfd6ab0a1bb768f4529a1df
- SHA1 1f7fe727ad7c319c63e672513849a95058f3c441
- SHA512 393d315670fb43306a5d5d1cd8f361ebf04fe5d8c46745f05f7855a523c8626da34aa1f40ebd7b522df734634459d448cf9516b30ce6df5e8b82fb6bc52ea97a
- SSDEEP 192:dtxbavrNdl9bH9CxbGsTjOnaVh6is6rJVum3:/Ravrbl9D9pnaVh6l4JVum3
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\T6ZUWF2V.txt
- Size 364B
- SHA256 6d669329e157fb871524d78de1b0cc70d55056bb184166fd9c3355c05a4f7560
- MD5 f95ae29118901dba022d18d40821f559
- SHA1 46b84e276be832f1a078f5f2118fa5381e989ef5
- SHA512 1e31b5e6fd77dd9860d70c2988bec2a633a40767458cd3b348dc93608aec86d024b33ee8c81e0a65657856e778fa8e27008fbc04a432e646d7578ad4da9d20e3
- MD5 SHA1 SHA512
- Path \Users\Admin\AppData\Local\Temp\FANBooster131\FANBooster131.exe
- Size 644KB
- SHA256 aff391c091668dbdeca8e5f3d2ffbc20475a4a5cca8262ce4e371a71f9ad322b
- MD5 2dfa3ac357a4c0135861d6d5d5343530
- SHA1 4b448c028c7e06e15635a39afab996b5a4399385
- SHA512 5fb4eb18c749884d9266956145d058450dbb4adfb781f3a7de8ba99a01c28100e14862232a00aba9f6efe29d225d701c55e620eb3e99aad442a6223f5f8a4c9f
- SSDEEP 12288:ACvx20lHfYFVR8xKpICxfwxeq8nIyyL9C6RAGtbWOs:Ac20ZgFVRNpI8INxPANOs
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\rb7ZA41.exe
- Size 2.4MB
- SHA256 d14a5df5adbd3ee1ab523a2acc9d564f28b94e11d191796dfff36fac617f06c4
- MD5 a925eded72abe679aa3cc989cd5d9385
- SHA1 d9e52619ba8494bbf9cc8eb76cf39f9d7a6ab022
- SHA512 4e7990ab11e56ef9a9170e2c8f9de6759788238aa83eeea560bf3eccb6c8153310b1055260a1844158a1a866a31c4264b898b279a808a0ea8bfae41e6c5dd333
- SSDEEP 49152:D8VxUuYo42RwVFRMg/CENpXDwt//80Wk8hwwSpPmynfHMIyzIf:AbP41rRMg/CWpi3VqLU3PMIyzE
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP000.TMP\rb7ZA41.exe
- Size 888KB
- SHA256 750fdc82023d1039b740b935e7f4ad0e76d06d07ab8d0c4dee749a70feacdfca
- MD5 e0375266dd39d7b4af28f7a25bf2cc5f
- SHA1 8e94708c713bda7e910627d68043a016af21c773
- SHA512 a517e10689f4a6c5ffa9227e6e7807b3de3c36f2b1fa293b2609d509f295c840a96f373d22e7ab027043a216f12de4c8e66d254c6c5fc8af4512ab9557b93eb1
- SSDEEP 24576:0y8Vq6H0Dqa5o42RwVoy7R/U0Z1FVRCp6V:D8VxUuYo42RwVFRMg/CEV
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\te3ZF22.exe
- Size 532KB
- SHA256 d67f9d9e7ad9647328fe4fb12b973b4b8ce0221644d37273b17d9bd04c6bcc74
- MD5 53c2b9436d81bab85da73d4cb5b7cffb
- SHA1 0bb72cb2a77d4e7ac336f68ef6fdb8a606509cc3
- SHA512 3556de6d1a29e1775c6487331230b707ecc7154225e2abfd5958460debe16b6ef782e86359473df370cc340236c5ae2e2c50d2f79b4c769055c11ee04e293e58
- SSDEEP 12288:WMryy90o6FzD3L5op86Y2R25KzNna4yszUiI:Uy36FzD3L5o02R2cNyYBI
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP001.TMP\te3ZF22.exe
- Size 479KB
- SHA256 1b77f6be946acace21615bea060b69af54f2cc10f6503e4471474e8349563f9a
- MD5 28e1166c4865682f29e9a574520aaf7a
- SHA1 0404c64d02311f00d1cad0d123294b5202b04e98
- SHA512 ada6ae25226bd3ea397abcdbb51b1b83fa311102a4c156d9fb000eed9e01437382cd49dbad6cc637718d99acdae577ad8cf9e9d2be29ec586778c30677448953
- SSDEEP 12288:WMryy90o6FzD3L5op86Y2R25KzNna4yszU4:Uy36FzD3L5o02R2cNyYJ
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\2xr5439.exe
- Size 570KB
- SHA256 b5e62ae0e7b8df30bfc65fcc7ee9cbbac7958414b2f16cb98c55f573ed6a1066
- MD5 e5eab20422383287726fe1beae3d09a4
- SHA1 fe448a6a6a354183a61d6b51facdc6bf559bf2dd
- SHA512 9427e7d8895ef2b4fc0453169666e805dae97b4a4b086f4efd9aea1b92d855abb243410656e1b7829bbddaa8e13236f4a7e688a104a9c65fe526439d1b275f99
- SSDEEP 12288:5qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNG6:5qDEvCTbMWu7rQYlBQcBiL
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\2xr5439.exe
- Size 354KB
- SHA256 27142c3e71be1acbc5ed89aa3ea01d5b4719ea9e061200e74718094c39db5ed1
- MD5 6928cc3bfc48d47789bb8e31723428b9
- SHA1 24e1bd921a361b12fb5f4522899099fbe885069e
- SHA512 bdd2a8fe4ae83a299d0938f139e37ac1311cf90eed42727556e97203547207251c421c8cd396195ea4ec6cefcfe1d43e8a1d2c2bfd27793feff4f4575032a60c
- SSDEEP 6144:5bV6ZXz5ah5zdgijxgUo+j9cr04DdbzNlUpWu/AvKiK9nnPEe4e7b8DXe4MDZV:5qDEvFo+yo4DdbbMWu/jrQu4M9V
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\5ik2kS2.exe
- Size 1.5MB
- SHA256 d7dd9ecebcbb7f231089d5f387682120d46a895b652f5a9c6ee663b1922fa8b4
- MD5 5029a0767b3bb36cd7105e83778330ea
- SHA1 83d56d1f28cf29b87e26917bf17b70edeef7724a
- SHA512 c2872608b20a7b53414573c30317f1c0bca3ab4e69dd47b21900b63e7b2691c65278d03504314ff4043a33eed5bfe36cff8be13b771a5115bb6aac1691e837ed
- SSDEEP 24576:Ac20ZgFVRNpI8INxPANOQeFg/KhRRUf/wThgXJyMDPp1eTmbCJSy:AbgeNK8fXeFg/BZPD6IC
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\5ik2kS2.exe
- Size 251KB
- SHA256 a0cbf4a149fe1d980f5e5fef1ce6169761c42b37f14b79ecb33c1900fb0300c2
- MD5 adf4680f6becd25a6b02b5a294b1172f
- SHA1 32efc7c488057b4599efbcc8b5e1ca4167f9c52e
- SHA512 509bcff2fd2d3f567854b02c7f59dc00d66ab2ed6dc350c000c5e02115972216ee2e72ffe8f6976d99e2a7b782069f47dea8c587e813b5fa2001de68e0331d25
- SSDEEP 6144:tipyC6p/FvYWU79Ii0CsHnfYV/gYRoM5cpxKpGuBCv:ACvx20lHfYFVR8xKpq
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\IXP002.TMP\5ik2kS2.exe
- Size 207KB
- SHA256 50c88c64e5c5939cf24cd5a5645f30e6a976f8e391dd8d267db3bfc23d4d0633
- MD5 c7ce45f7e35a877046aa96b89c4865d8
- SHA1 e2024ccf29397fa784d16785e04a5dc3b532e301
- SHA512 28ffe65505f0a6711b329ef71521af6965f74f7f1b5d405b7e28cbf6d5d5e2cdc9b3fcbcdf591e2b1112baf834e520d8de0c476b2e246bbbcfb5f2a9965bc54a
- SSDEEP 6144:tipyC6p/FvYWU79Ii0CsHnfYV/gYRoM5cw:ACvx20lHfYFVRF
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\tempAVSyblMyytL8U0P\sqlite3.dll
- Size 791KB
- SHA256 0c7cd52abdb6eb3e556d81caac398a127495e4a251ef600e6505a81385a1982d
- MD5 0fe0a178f711b623a8897e4b0bb040d1
- SHA1 01ea412aeab3d331f825d93d7ee1f5fa6d3c46e6
- SHA512 6c53c489c4464b9dc9a5dd31c48bb4afa65f7d6df9cc71e705cea2074ebd5e249cad4894eac6f6b308b3574633bc6e1706dfc5fda5f46c27f1e37d21e65fbc54
- SSDEEP 24576:2/ZHet+kwxRLvxx/ccPA7leR+g/oU6xGmdRA7G4fRjqTr:eZ+t+v/nMleR+g/oUI/dmi4cT
- MD5 SHA1 SHA512 SSDEEP